59 files changed, 1258 insertions, 1107 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e3854696988d..ea0755b09033 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3,7 +3,7 @@
  *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  *
  *      $Id: addrconf.c,v 1.69 2001/10/31 21:55:54 davem Exp $
@@ -105,7 +105,7 @@ static void addrconf_sysctl_unregister(struct ipv6_devconf *p);
 
 #ifdef CONFIG_IPV6_PRIVACY
 static int __ipv6_regen_rndid(struct inet6_dev *idev);
-static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr); 
+static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
 static void ipv6_regen_rndid(unsigned long data);
 
 static int desync_factor = MAX_DESYNC_FACTOR * HZ;
@@ -137,7 +137,7 @@ static void addrconf_rs_timer(unsigned long data);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 
-static void inet6_prefix_notify(int event, struct inet6_dev *idev, 
+static void inet6_prefix_notify(int event, struct inet6_dev *idev,
                                 struct prefix_info *pinfo);
 static int ipv6_chk_same_addr(const struct in6_addr *addr, struct net_device *dev);
 
@@ -241,7 +241,7 @@ int __ipv6_addr_type(const struct in6_addr *addr)
          */
         if ((st & htonl(0xE0000000)) != htonl(0x00000000) &&
             (st & htonl(0xE0000000)) != htonl(0xE0000000))
-                return (IPV6_ADDR_UNICAST | 
+                return (IPV6_ADDR_UNICAST |
                         IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));
 
         if ((st & htonl(0xFF000000)) == htonl(0xFF000000)) {
@@ -252,7 +252,7 @@ int __ipv6_addr_type(const struct in6_addr *addr)
         }
 
         if ((st & htonl(0xFFC00000)) == htonl(0xFE800000))
-                return (IPV6_ADDR_LINKLOCAL | IPV6_ADDR_UNICAST | 
+                return (IPV6_ADDR_LINKLOCAL | IPV6_ADDR_UNICAST |
                         IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_LINKLOCAL));               /* addr-select 3.1 */
         if ((st & htonl(0xFFC00000)) == htonl(0xFEC00000))
                 return (IPV6_ADDR_SITELOCAL | IPV6_ADDR_UNICAST |
@@ -272,11 +272,11 @@ int __ipv6_addr_type(const struct in6_addr *addr)
                 }
 
                 if (addr->s6_addr32[2] == htonl(0x0000ffff))
-                        return (IPV6_ADDR_MAPPED | 
+                        return (IPV6_ADDR_MAPPED |
                                 IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));  /* addr-select 3.3 */
         }
 
-        return (IPV6_ADDR_RESERVED | 
+        return (IPV6_ADDR_RESERVED |
                 IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));  /* addr-select 3.4 */
 }
 
@@ -348,10 +348,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         if (dev->mtu < IPV6_MIN_MTU)
                 return NULL;
 
-        ndev = kzalloc(sizeof(struct inet6_dev), GFP_KERNEL);
+        ndev = kzalloc(sizeof(struct inet6_dev), GFP_KERNEL);
 
-        if (ndev == NULL)
-                return NULL;
+        if (ndev == NULL)
+                return NULL;
 
         rwlock_init(&ndev->lock);
         ndev->dev = dev;
@@ -462,7 +462,7 @@ static void dev_forward_change(struct inet6_dev *idev)
         dev = idev->dev;
         if (dev && (dev->flags & IFF_MULTICAST)) {
                 ipv6_addr_all_routers(&addr);
-        
+
                 if (idev->cnf.forwarding)
                         ipv6_dev_mc_inc(dev, &addr);
                 else
@@ -817,8 +817,8 @@ retry:
         tmp_valid_lft = min_t(__u32,
                               ifp->valid_lft,
                               idev->cnf.temp_valid_lft);
-        tmp_prefered_lft = min_t(__u32, 
-                                 ifp->prefered_lft, 
+        tmp_prefered_lft = min_t(__u32,
+                                 ifp->prefered_lft,
                                  idev->cnf.temp_prefered_lft - desync_factor / HZ);
         tmp_plen = ifp->prefix_len;
         max_addresses = idev->cnf.max_addresses;
@@ -828,7 +828,7 @@ retry:
 
         write_unlock(&idev->lock);
         ift = !max_addresses ||
-              ipv6_count_addresses(idev) < max_addresses ? 
+              ipv6_count_addresses(idev) < max_addresses ?
                 ipv6_add_addr(idev, &addr, tmp_plen,
                               ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK, IFA_F_TEMPORARY) : NULL;
         if (!ift || IS_ERR(ift)) {
@@ -1160,7 +1160,7 @@ record_it:
 
         if (!ifa_result)
                 return -EADDRNOTAVAIL;
-        
+
         ipv6_addr_copy(saddr, &ifa_result->addr);
         in6_ifa_put(ifa_result);
         return 0;
@@ -1475,7 +1475,7 @@ regen:
          *  - value 0
          *  - XXX: already assigned to an address on the device
          */
-        if (idev->rndid[0] == 0xfd && 
+        if (idev->rndid[0] == 0xfd &&
             (idev->rndid[1]&idev->rndid[2]&idev->rndid[3]&idev->rndid[4]&idev->rndid[5]&idev->rndid[6]) == 0xff &&
             (idev->rndid[7]&0x80))
                 goto regen;
@@ -1502,9 +1502,9 @@ static void ipv6_regen_rndid(unsigned long data)
 
         if (__ipv6_regen_rndid(idev) < 0)
                 goto out;
-        
+
         expires = jiffies +
-                idev->cnf.temp_prefered_lft * HZ - 
+                idev->cnf.temp_prefered_lft * HZ -
                 idev->cnf.regen_max_retry * idev->cnf.dad_transmits * idev->nd_parms->retrans_time - desync_factor;
         if (time_before(expires, jiffies)) {
                 printk(KERN_WARNING
@@ -1630,12 +1630,12 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
         struct inet6_dev *in6_dev;
 
         pinfo = (struct prefix_info *) opt;
-        
+
         if (len < sizeof(struct prefix_info)) {
                 ADBG(("addrconf: prefix option too short\n"));
                 return;
         }
-        
+
         /*
          *      Validation checks ([ADDRCONF], page 19)
          */
@@ -1827,7 +1827,7 @@ ok:
                                  * When a new public address is created as described in [ADDRCONF],
                                  * also create a new temporary address.
                                  */
-                                read_unlock_bh(&in6_dev->lock); 
+                                read_unlock_bh(&in6_dev->lock);
                                 ipv6_create_tempaddr(ifp, NULL);
                         } else {
                                 read_unlock_bh(&in6_dev->lock);
@@ -1913,14 +1913,14 @@ static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen,
         int scope;
 
         ASSERT_RTNL();
-        
+
         /* check the lifetime */
         if (!valid_lft || prefered_lft > valid_lft)
                 return -EINVAL;
 
         if ((dev = __dev_get_by_index(ifindex)) == NULL)
                 return -ENODEV;
-        
+
         if ((idev = addrconf_add_dev(dev)) == NULL)
                 return -ENOBUFS;
 
@@ -1960,7 +1960,7 @@ static int inet6_addr_del(int ifindex, struct in6_addr *pfx, int plen)
         struct inet6_ifaddr *ifp;
         struct inet6_dev *idev;
         struct net_device *dev;
-        
+
         if ((dev = __dev_get_by_index(ifindex)) == NULL)
                 return -ENODEV;
 
@@ -1973,7 +1973,7 @@ static int inet6_addr_del(int ifindex, struct in6_addr *pfx, int plen)
                     ipv6_addr_equal(pfx, &ifp->addr)) {
                         in6_ifa_hold(ifp);
                         read_unlock_bh(&idev->lock);
-                        
+
                         ipv6_del_addr(ifp);
 
                         /* If the last address is deleted administratively,
@@ -1993,10 +1993,10 @@ int addrconf_add_ifaddr(void __user *arg)
 {
         struct in6_ifreq ireq;
         int err;
-        
+
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
-        
+
         if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
                 return -EFAULT;
 
@@ -2011,7 +2011,7 @@ int addrconf_del_ifaddr(void __user *arg)
 {
         struct in6_ifreq ireq;
         int err;
-        
+
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
@@ -2056,7 +2056,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                 return;
         }
 
-        for (dev = dev_base; dev != NULL; dev = dev->next) {
+        for (dev = dev_base; dev != NULL; dev = dev->next) {
                 struct in_device * in_dev = __in_dev_get_rtnl(dev);
                 if (in_dev && (dev->flags & IFF_UP)) {
                         struct in_ifaddr * ifa;
@@ -2091,7 +2091,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                                 }
                         }
                 }
-        }
+        }
 }
 #endif
 
@@ -2137,7 +2137,7 @@ static void addrconf_dev_config(struct net_device *dev)
 
         ASSERT_RTNL();
 
-        if ((dev->type != ARPHRD_ETHER) && 
+        if ((dev->type != ARPHRD_ETHER) &&
             (dev->type != ARPHRD_FDDI) &&
             (dev->type != ARPHRD_IEEE802_TR) &&
             (dev->type != ARPHRD_ARCNET) &&
@@ -2164,9 +2164,9 @@ static void addrconf_sit_config(struct net_device *dev)
 
         ASSERT_RTNL();
 
-        /* 
-         * Configure the tunnel with one of our IPv4 
-         * addresses... we should configure all of 
+        /*
+         * Configure the tunnel with one of our IPv4
+         * addresses... we should configure all of
          * our v4 addrs in the tunnel
          */
 
@@ -2233,7 +2233,7 @@ static void addrconf_ip6_tnl_config(struct net_device *dev)
         ip6_tnl_add_linklocal(idev);
 }
 
-static int addrconf_notify(struct notifier_block *this, unsigned long event, 
+static int addrconf_notify(struct notifier_block *this, unsigned long event,
                            void * data)
 {
         struct net_device *dev = (struct net_device *) data;
@@ -2378,7 +2378,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                 return -ENODEV;
 
         /* Step 1: remove reference to ipv6 device from parent device.
-                   Do not dev_put!
+                   Do not dev_put!
          */
         if (how == 1) {
                 idev->dead = 1;
@@ -2461,7 +2461,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         /* Step 5: netlink notification of this interface */
         idev->tstamp = jiffies;
         inet6_ifinfo_notify(RTM_DELLINK, idev);
-        
+
         /* Shot the device (if unregistered) */
 
         if (how == 1) {
@@ -2776,7 +2776,7 @@ out_kfree:
         goto out;
 }
 
-static struct file_operations if6_fops = {
+static const struct file_operations if6_fops = {
         .owner          = THIS_MODULE,
         .open           = if6_seq_open,
         .read           = seq_read,
@@ -2850,8 +2850,8 @@ restart:
                         age = (now - ifp->tstamp) / HZ;
 
 #ifdef CONFIG_IPV6_PRIVACY
-                        regen_advance = ifp->idev->cnf.regen_max_retry * 
-                                        ifp->idev->cnf.dad_transmits * 
+                        regen_advance = ifp->idev->cnf.regen_max_retry *
+                                        ifp->idev->cnf.dad_transmits *
                                         ifp->idev->nd_parms->retrans_time / HZ;
 #endif
 
@@ -3117,7 +3117,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
                       ifa->idev->dev->ifindex);
@@ -3137,8 +3137,10 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
         }
 
         if (nla_put(skb, IFA_ADDRESS, 16, &ifa->addr) < 0 ||
-            put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0)
-                return nlmsg_cancel(skb, nlh);
+            put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0) {
+                nlmsg_cancel(skb, nlh);
+                return -EMSGSIZE;
+        }
 
         return nlmsg_end(skb, nlh);
 }
@@ -3155,13 +3157,15 @@ static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
         if (nla_put(skb, IFA_MULTICAST, 16, &ifmca->mca_addr) < 0 ||
             put_cacheinfo(skb, ifmca->mca_cstamp, ifmca->mca_tstamp,
-                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0)
-                return nlmsg_cancel(skb, nlh);
+                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
+                nlmsg_cancel(skb, nlh);
+                return -EMSGSIZE;
+        }
 
         return nlmsg_end(skb, nlh);
 }
@@ -3178,13 +3182,15 @@ static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
         if (nla_put(skb, IFA_ANYCAST, 16, &ifaca->aca_addr) < 0 ||
             put_cacheinfo(skb, ifaca->aca_cstamp, ifaca->aca_tstamp,
-                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0)
-                return nlmsg_cancel(skb, nlh);
+                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
+                nlmsg_cancel(skb, nlh);
+                return -EMSGSIZE;
+        }
 
         return nlmsg_end(skb, nlh);
 }
@@ -3211,7 +3217,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
         s_idx = cb->args[0];
         s_ip_idx = ip_idx = cb->args[1];
         read_lock(&dev_base_lock);
-        
+
         for (dev = dev_base, idx = 0; dev; dev = dev->next, idx++) {
                 if (idx < s_idx)
                         continue;
@@ -3228,8 +3234,8 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                              ifa = ifa->if_next, ip_idx++) {
                                 if (ip_idx < s_ip_idx)
                                         continue;
-                                if ((err = inet6_fill_ifaddr(skb, ifa, 
-                                    NETLINK_CB(cb->skb).pid, 
+                                if ((err = inet6_fill_ifaddr(skb, ifa,
+                                    NETLINK_CB(cb->skb).pid,
                                     cb->nlh->nlmsg_seq, RTM_NEWADDR,
                                     NLM_F_MULTI)) <= 0)
                                         goto done;
@@ -3237,12 +3243,12 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                         break;
                 case MULTICAST_ADDR:
                         /* multicast address */
-                        for (ifmca = idev->mc_list; ifmca; 
+                        for (ifmca = idev->mc_list; ifmca;
                              ifmca = ifmca->next, ip_idx++) {
                                 if (ip_idx < s_ip_idx)
                                         continue;
-                                if ((err = inet6_fill_ifmcaddr(skb, ifmca, 
-                                    NETLINK_CB(cb->skb).pid, 
+                                if ((err = inet6_fill_ifmcaddr(skb, ifmca,
+                                    NETLINK_CB(cb->skb).pid,
                                     cb->nlh->nlmsg_seq, RTM_GETMULTICAST,
                                     NLM_F_MULTI)) <= 0)
                                         goto done;
@@ -3254,10 +3260,10 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                              ifaca = ifaca->aca_next, ip_idx++) {
                                 if (ip_idx < s_ip_idx)
                                         continue;
-                                if ((err = inet6_fill_ifacaddr(skb, ifaca, 
-                                    NETLINK_CB(cb->skb).pid, 
+                                if ((err = inet6_fill_ifacaddr(skb, ifaca,
+                                    NETLINK_CB(cb->skb).pid,
                                     cb->nlh->nlmsg_seq, RTM_GETANYCAST,
-                                    NLM_F_MULTI)) <= 0) 
+                                    NLM_F_MULTI)) <= 0)
                                         goto done;
                         }
                         break;
@@ -3334,9 +3340,12 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr* nlh,
 
         err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).pid,
                                 nlh->nlmsg_seq, RTM_NEWADDR, 0);
-        /* failure implies BUG in inet6_ifaddr_msgsize() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout_ifa;
+        }
         err = rtnl_unicast(skb, NETLINK_CB(in_skb).pid);
 errout_ifa:
         in6_ifa_put(ifa);
@@ -3354,9 +3363,12 @@ static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
                 goto errout;
 
         err = inet6_fill_ifaddr(skb, ifa, 0, 0, event, 0);
-        /* failure implies BUG in inet6_ifaddr_msgsize() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
@@ -3414,7 +3426,7 @@ static inline size_t inet6_if_nlmsg_size(void)
                  );
 }
 
-static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev, 
+static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
                              u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct net_device *dev = idev->dev;
@@ -3426,7 +3438,7 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*hdr), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         hdr = nlmsg_data(nlh);
         hdr->ifi_family = AF_INET6;
@@ -3469,7 +3481,8 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
@@ -3485,7 +3498,7 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                         continue;
                 if ((idev = in6_dev_get(dev)) == NULL)
                         continue;
-                err = inet6_fill_ifinfo(skb, idev, NETLINK_CB(cb->skb).pid, 
+                err = inet6_fill_ifinfo(skb, idev, NETLINK_CB(cb->skb).pid,
                                 cb->nlh->nlmsg_seq, RTM_NEWLINK, NLM_F_MULTI);
                 in6_dev_put(idev);
                 if (err <= 0)
@@ -3501,15 +3514,18 @@ void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
 {
         struct sk_buff *skb;
         int err = -ENOBUFS;
-        
+
         skb = nlmsg_new(inet6_if_nlmsg_size(), GFP_ATOMIC);
         if (skb == NULL)
                 goto errout;
 
         err = inet6_fill_ifinfo(skb, idev, 0, 0, event, 0);
-        /* failure implies BUG in inet6_if_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in inet6_if_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
@@ -3533,7 +3549,7 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*pmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         pmsg = nlmsg_data(nlh);
         pmsg->prefix_family = AF_INET6;
@@ -3558,10 +3574,11 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
-static void inet6_prefix_notify(int event, struct inet6_dev *idev, 
+static void inet6_prefix_notify(int event, struct inet6_dev *idev,
                          struct prefix_info *pinfo)
 {
         struct sk_buff *skb;
@@ -3572,9 +3589,12 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
                 goto errout;
 
         err = inet6_fill_prefix(skb, idev, pinfo, 0, 0, event, 0);
-        /* failure implies BUG in inet6_prefix_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in inet6_prefix_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
@@ -3655,10 +3675,10 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
                         rt6_purge_dflt_routers();
         }
 
-        return ret;
+        return ret;
 }
 
-static int addrconf_sysctl_forward_strategy(ctl_table *table, 
+static int addrconf_sysctl_forward_strategy(ctl_table *table,
                                             int __user *name, int nlen,
                                             void __user *oldval,
                                             size_t __user *oldlenp,
@@ -3723,19 +3743,19 @@ static struct addrconf_sysctl_table
 } addrconf_sysctl __read_mostly = {
         .sysctl_header = NULL,
         .addrconf_vars = {
-                {
+                {
                         .ctl_name       =       NET_IPV6_FORWARDING,
                         .procname       =       "forwarding",
-                        .data           =       &ipv6_devconf.forwarding,
+                        .data           =       &ipv6_devconf.forwarding,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &addrconf_sysctl_forward,
+                        .proc_handler   =       &addrconf_sysctl_forward,
                         .strategy       =       &addrconf_sysctl_forward_strategy,
                 },
                 {
                         .ctl_name       =       NET_IPV6_HOP_LIMIT,
                         .procname       =       "hop_limit",
-                        .data           =       &ipv6_devconf.hop_limit,
+                        .data           =       &ipv6_devconf.hop_limit,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
                         .proc_handler   =       proc_dointvec,
@@ -3744,116 +3764,116 @@ static struct addrconf_sysctl_table
                         .ctl_name       =       NET_IPV6_MTU,
                         .procname       =       "mtu",
                         .data           =       &ipv6_devconf.mtu6,
-                        .maxlen         =       sizeof(int),
+                        .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_RA,
                         .procname       =       "accept_ra",
-                        .data           =       &ipv6_devconf.accept_ra,
+                        .data           =       &ipv6_devconf.accept_ra,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_REDIRECTS,
                         .procname       =       "accept_redirects",
-                        .data           =       &ipv6_devconf.accept_redirects,
+                        .data           =       &ipv6_devconf.accept_redirects,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_AUTOCONF,
                         .procname       =       "autoconf",
-                        .data           =       &ipv6_devconf.autoconf,
+                        .data           =       &ipv6_devconf.autoconf,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_DAD_TRANSMITS,
                         .procname       =       "dad_transmits",
-                        .data           =       &ipv6_devconf.dad_transmits,
+                        .data           =       &ipv6_devconf.dad_transmits,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_RTR_SOLICITS,
                         .procname       =       "router_solicitations",
-                        .data           =       &ipv6_devconf.rtr_solicits,
+                        .data           =       &ipv6_devconf.rtr_solicits,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_RTR_SOLICIT_INTERVAL,
                         .procname       =       "router_solicitation_interval",
-                        .data           =       &ipv6_devconf.rtr_solicit_interval,
+                        .data           =       &ipv6_devconf.rtr_solicit_interval,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec_jiffies,
+                        .proc_handler   =       &proc_dointvec_jiffies,
                         .strategy       =       &sysctl_jiffies,
                 },
                 {
                         .ctl_name       =       NET_IPV6_RTR_SOLICIT_DELAY,
                         .procname       =       "router_solicitation_delay",
-                        .data           =       &ipv6_devconf.rtr_solicit_delay,
+                        .data           =       &ipv6_devconf.rtr_solicit_delay,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec_jiffies,
+                        .proc_handler   =       &proc_dointvec_jiffies,
                         .strategy       =       &sysctl_jiffies,
                 },
                 {
                         .ctl_name       =       NET_IPV6_FORCE_MLD_VERSION,
                         .procname       =       "force_mld_version",
-                        .data           =       &ipv6_devconf.force_mld_version,
+                        .data           =       &ipv6_devconf.force_mld_version,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
 #ifdef CONFIG_IPV6_PRIVACY
                 {
                         .ctl_name       =       NET_IPV6_USE_TEMPADDR,
                         .procname       =       "use_tempaddr",
-                        .data           =       &ipv6_devconf.use_tempaddr,
+                        .data           =       &ipv6_devconf.use_tempaddr,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_TEMP_VALID_LFT,
                         .procname       =       "temp_valid_lft",
-                        .data           =       &ipv6_devconf.temp_valid_lft,
+                        .data           =       &ipv6_devconf.temp_valid_lft,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_TEMP_PREFERED_LFT,
                         .procname       =       "temp_prefered_lft",
-                        .data           =       &ipv6_devconf.temp_prefered_lft,
+                        .data           =       &ipv6_devconf.temp_prefered_lft,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_REGEN_MAX_RETRY,
                         .procname       =       "regen_max_retry",
-                        .data           =       &ipv6_devconf.regen_max_retry,
+                        .data           =       &ipv6_devconf.regen_max_retry,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_MAX_DESYNC_FACTOR,
                         .procname       =       "max_desync_factor",
-                        .data           =       &ipv6_devconf.max_desync_factor,
+                        .data           =       &ipv6_devconf.max_desync_factor,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
 #endif
                 {
@@ -3867,18 +3887,18 @@ static struct addrconf_sysctl_table
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_RA_DEFRTR,
                         .procname       =       "accept_ra_defrtr",
-                        .data           =       &ipv6_devconf.accept_ra_defrtr,
+                        .data           =       &ipv6_devconf.accept_ra_defrtr,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_RA_PINFO,
                         .procname       =       "accept_ra_pinfo",
-                        .data           =       &ipv6_devconf.accept_ra_pinfo,
+                        .data           =       &ipv6_devconf.accept_ra_pinfo,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       &proc_dointvec,
                 },
 #ifdef CONFIG_IPV6_ROUTER_PREF
                 {
@@ -3983,18 +4003,18 @@ static void addrconf_sysctl_register(struct inet6_dev *idev, struct ipv6_devconf
                 t->addrconf_vars[i].extra1 = idev; /* embedded; no ref */
         }
         if (dev) {
-                dev_name = dev->name; 
+                dev_name = dev->name;
                 t->addrconf_dev[0].ctl_name = dev->ifindex;
         } else {
                 dev_name = "default";
                 t->addrconf_dev[0].ctl_name = NET_PROTO_CONF_DEFAULT;
         }
 
-        /* 
-         * Make a copy of dev_name, because '.procname' is regarded as const 
+        /*
+         * Make a copy of dev_name, because '.procname' is regarded as const
          * by sysctl and we wouldn't want anyone to change it under our feet
          * (see SIOCSIFNAME).
-         */     
+         */
         dev_name = kstrdup(dev_name, GFP_KERNEL);
         if (!dev_name)
             goto free;
@@ -4046,12 +4066,12 @@ static void addrconf_sysctl_unregister(struct ipv6_devconf *p)
 
 int register_inet6addr_notifier(struct notifier_block *nb)
 {
-        return atomic_notifier_chain_register(&inet6addr_chain, nb);
+        return atomic_notifier_chain_register(&inet6addr_chain, nb);
 }
 
 int unregister_inet6addr_notifier(struct notifier_block *nb)
 {
-        return atomic_notifier_chain_unregister(&inet6addr_chain,nb);
+        return atomic_notifier_chain_unregister(&inet6addr_chain,nb);
 }
 
 /*
@@ -4104,9 +4124,9 @@ int __init addrconf_init(void)
 
 void __exit addrconf_cleanup(void)
 {
-        struct net_device *dev;
-        struct inet6_dev *idev;
-        struct inet6_ifaddr *ifa;
+        struct net_device *dev;
+        struct inet6_dev *idev;
+        struct inet6_ifaddr *ifa;
         int i;
 
         unregister_netdevice_notifier(&ipv6_dev_notf);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 0e0e4262f4dc..a006d242be76 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -1,9 +1,9 @@
 /*
  *      PF_INET6 socket protocol family
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      Adapted from linux/net/ipv4/af_inet.c
  *
@@ -191,7 +191,7 @@ lookup_protocol:
         np->mc_loop     = 1;
         np->pmtudisc    = IPV6_PMTUDISC_WANT;
         np->ipv6only    = sysctl_ipv6_bindv6only;
-        
+
         /* Init the ipv4 part of the socket since we can have sockets
          * using v6 API for ipv4.
          */
@@ -206,7 +206,7 @@ lookup_protocol:
                 inet->pmtudisc = IP_PMTUDISC_DONT;
         else
                 inet->pmtudisc = IP_PMTUDISC_WANT;
-        /* 
+        /*
          * Increment only the relevant sk_prot->socks debug field, this changes
          * the previous behaviour of incrementing both the equivalent to
          * answer->prot->socks (inet6_sock_nr) and inet_sock_nr.
@@ -293,7 +293,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                                          */
                                         sk->sk_bound_dev_if = addr->sin6_scope_id;
                                 }
-                                
+
                                 /* Binding to link-local address requires an interface */
                                 if (!sk->sk_bound_dev_if) {
                                         err = -EINVAL;
@@ -327,7 +327,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         inet->saddr = v4addr;
 
         ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
-                
+
         if (!(addr_type & IPV6_ADDR_MULTICAST))
                 ipv6_addr_copy(&np->saddr, &addr->sin6_addr);
 
@@ -393,7 +393,7 @@ EXPORT_SYMBOL_GPL(inet6_destroy_sock);
 /*
  *      This does both peername and sockname.
  */
- 
+
 int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
                  int *uaddr_len, int peer)
 {
@@ -401,7 +401,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sock *sk = sock->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
-  
+
         sin->sin6_family = AF_INET6;
         sin->sin6_flowinfo = 0;
         sin->sin6_scope_id = 0;
@@ -433,14 +433,14 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
 
-        switch(cmd) 
+        switch(cmd)
         {
         case SIOCGSTAMP:
                 return sock_get_timestamp(sk, (struct timeval __user *)arg);
 
         case SIOCADDRT:
         case SIOCDELRT:
-          
+
                 return(ipv6_route_ioctl(cmd,(void __user *)arg));
 
         case SIOCSIFADDR:
@@ -584,7 +584,7 @@ inet6_register_protosw(struct inet_protosw *p)
         /* Add the new entry after the last permanent entry if any, so that
          * the new entry does not override a permanent entry when matched with
          * a wild-card protocol. But it is allowed to override any existing
-         * non-permanent entry.  This means that when we remove this entry, the 
+         * non-permanent entry.  This means that when we remove this entry, the
          * system automatically returns to the old behavior.
          */
         list_add_rcu(&p->list, last_perm);
@@ -749,7 +749,7 @@ err_icmp_mib:
         snmp6_mib_free((void **)ipv6_statistics);
 err_ip_mib:
         return -ENOMEM;
-        
+
 }
 
 static void cleanup_ipv6_mibs(void)
@@ -763,7 +763,7 @@ static void cleanup_ipv6_mibs(void)
 static int __init inet6_init(void)
 {
         struct sk_buff *dummy_skb;
-        struct list_head *r;
+        struct list_head *r;
         int err;
 
         BUILD_BUG_ON(sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb));
@@ -814,7 +814,7 @@ static int __init inet6_init(void)
         err = init_ipv6_mibs();
         if (err)
                 goto out_unregister_sock;
-        
+
         /*
          *      ipngwg API draft makes clear that the correct semantics
          *      for TCP and UDP is to consider one TCP and UDP instance
@@ -933,11 +933,11 @@ static void __exit inet6_exit(void)
 #ifdef CONFIG_PROC_FS
         if6_proc_exit();
         ac6_proc_exit();
-        ipv6_misc_proc_exit();
-        udp6_proc_exit();
-        udplite6_proc_exit();
-        tcp6_proc_exit();
-        raw6_proc_exit();
+        ipv6_misc_proc_exit();
+        udp6_proc_exit();
+        udplite6_proc_exit();
+        tcp6_proc_exit();
+        raw6_proc_exit();
 #endif
 #ifdef CONFIG_IPV6_MIP6
         mip6_fini();
@@ -952,7 +952,7 @@ static void __exit inet6_exit(void)
         ndisc_cleanup();
         icmpv6_cleanup();
 #ifdef CONFIG_SYSCTL
-        ipv6_sysctl_unregister();       
+        ipv6_sysctl_unregister();
 #endif
         cleanup_ipv6_mibs();
         proto_unregister(&rawv6_prot);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 12c5a4dec09e..dc68b7269c3c 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -1,26 +1,26 @@
 /*
  * Copyright (C)2002 USAGI/WIDE Project
- * 
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
  * Authors
  *
- *      Mitsuru KANDA @USAGI       : IPv6 Support 
+ *      Mitsuru KANDA @USAGI       : IPv6 Support
  *      Kazunori MIYAZAWA @USAGI   :
  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
- *      
+ *
  *      This file is derived from net/ipv4/ah.c.
  */
 
@@ -54,7 +54,7 @@ static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
                         optlen = 1;
                         break;
                 default:
-                        if (len < 2) 
+                        if (len < 2)
                                 goto bad;
                         optlen = opt[off+1]+2;
                         if (len < optlen)
@@ -152,7 +152,7 @@ static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
         segments_left = rthdr->segments_left;
         if (segments_left == 0)
                 return;
-        rthdr->segments_left = 0; 
+        rthdr->segments_left = 0;
 
         /* The value of rthdr->hdrlen has been verified either by the system
          * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming
@@ -278,7 +278,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->hop_limit   = 0;
 
         ahp = x->data;
-        ah->hdrlen  = (XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + 
+        ah->hdrlen  = (XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) +
                                    ahp->icv_trunc_len) >> 2) - 2;
 
         ah->reserved = 0;
@@ -319,7 +319,7 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
          * Moving the pointer of skb->nh.raw by using skb_pull as long as AH
          * header length. Then copy back the copy as long as hdr_len
          * If destination header following AH exists, copy it into after [Ext2].
-         * 
+         *
          * |<>|[IPv6][Ext1][Ext2][Dest][Payload]
          * There is offset of AH before IPv6 header after the process.
          */
@@ -347,9 +347,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         nexthdr = ah->nexthdr;
         ah_hlen = (ah->hdrlen + 2) << 2;
 
-        if (ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_full_len) &&
-            ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len))
-                goto out;
+        if (ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_full_len) &&
+            ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len))
+                goto out;
 
         if (!pskb_may_pull(skb, ah_hlen))
                 goto out;
@@ -365,7 +365,7 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         skb->nh.ipv6h->flow_lbl[2] = 0;
         skb->nh.ipv6h->hop_limit   = 0;
 
-        {
+        {
                 u8 auth_data[MAX_AH_AUTH_LEN];
 
                 memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
@@ -395,8 +395,8 @@ out:
         return err;
 }
 
-static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, 
-                    int type, int code, int offset, __be32 info)
+static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                    int type, int code, int offset, __be32 info)
 {
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
         struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);
@@ -445,7 +445,7 @@ static int ah6_init_state(struct xfrm_state *x)
         ahp->tfm = tfm;
         if (crypto_hash_setkey(tfm, ahp->key, ahp->key_len))
                 goto error;
-        
+
         /*
          * Lookup the algorithm description maintained by xfrm_algo,
          * verify crypto transform properties, and store information
@@ -462,16 +462,16 @@ static int ah6_init_state(struct xfrm_state *x)
                        aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
-        
+
         ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
         ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
-        
+
         BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
-        
+
         ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
         if (!ahp->work_icv)
                 goto error;
-        
+
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len);
         if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct ipv6hdr);
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index a9604764e015..6fb2e9d716c0 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -1,6 +1,6 @@
 /*
  *      Anycast support for IPv6
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
  *      David L Stevens (dlstevens@us.ibm.com)
@@ -397,7 +397,7 @@ static int ipv6_dev_ac_dec(struct net_device *dev, struct in6_addr *addr)
         in6_dev_put(idev);
         return ret;
 }
-        
+
 /*
  *      check if the interface has this anycast address
  */
@@ -565,7 +565,7 @@ out_kfree:
         goto out;
 }
 
-static struct file_operations ac6_seq_fops = {
+static const struct file_operations ac6_seq_fops = {
         .owner          =       THIS_MODULE,
         .open           =       ac6_seq_open,
         .read           =       seq_read,
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 5c94fea90e97..5f54dec3e205 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -1,9 +1,9 @@
 /*
  *      common UDP/RAW code
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      $Id: datagram.c,v 1.24 2002/02/01 22:01:04 davem Exp $
  *
@@ -55,10 +55,10 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         }
 
         if (addr_len < SIN6_LEN_RFC2133)
-                return -EINVAL;
+                return -EINVAL;
 
-        if (usin->sin6_family != AF_INET6) 
-                return -EAFNOSUPPORT;
+        if (usin->sin6_family != AF_INET6)
+                return -EAFNOSUPPORT;
 
         memset(&fl, 0, sizeof(fl));
         if (np->sndflow) {
@@ -93,14 +93,14 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 sin.sin_addr.s_addr = daddr->s6_addr32[3];
                 sin.sin_port = usin->sin6_port;
 
-                err = ip4_datagram_connect(sk, 
-                                           (struct sockaddr*) &sin, 
+                err = ip4_datagram_connect(sk,
+                                           (struct sockaddr*) &sin,
                                            sizeof(sin));
 
 ipv4_connected:
                 if (err)
                         goto out;
-                
+
                 ipv6_addr_set(&np->daddr, 0, 0, htonl(0x0000ffff), inet->daddr);
 
                 if (ipv6_addr_any(&np->saddr)) {
@@ -178,7 +178,7 @@ ipv4_connected:
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+        if ((err = xfrm_lookup(&dst, &fl, sk, 1)) < 0)
                 goto out;
 
         /* source address lookup done in ip6_dst_lookup */
@@ -206,7 +206,7 @@ out:
         return err;
 }
 
-void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, 
+void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
                      __be16 port, u32 info, u8 *payload)
 {
         struct ipv6_pinfo *np  = inet6_sk(sk);
@@ -223,7 +223,7 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
         serr = SKB_EXT_ERR(skb);
         serr->ee.ee_errno = err;
         serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6;
-        serr->ee.ee_type = icmph->icmp6_type; 
+        serr->ee.ee_type = icmph->icmp6_type;
         serr->ee.ee_code = icmph->icmp6_code;
         serr->ee.ee_pad = 0;
         serr->ee.ee_info = info;
@@ -259,7 +259,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
         serr = SKB_EXT_ERR(skb);
         serr->ee.ee_errno = err;
         serr->ee.ee_origin = SO_EE_ORIGIN_LOCAL;
-        serr->ee.ee_type = 0; 
+        serr->ee.ee_type = 0;
         serr->ee.ee_code = 0;
         serr->ee.ee_pad = 0;
         serr->ee.ee_info = info;
@@ -274,7 +274,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
                 kfree_skb(skb);
 }
 
-/* 
+/*
  *      Handle MSG_ERRQUEUE
  */
 int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
@@ -312,7 +312,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
         if (sin) {
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
-                sin->sin6_port = serr->port; 
+                sin->sin6_port = serr->port;
                 sin->sin6_scope_id = 0;
                 if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
                         ipv6_addr_copy(&sin->sin6_addr,
@@ -370,7 +370,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 spin_unlock_bh(&sk->sk_error_queue.lock);
         }
 
-out_free_skb:   
+out_free_skb:
         kfree_skb(skb);
 out:
         return err;
@@ -419,7 +419,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                  * report extension headers (except for HbH)
                  * in order.
                  *
-                 * Also note that IPV6_RECVRTHDRDSTOPTS is NOT 
+                 * Also note that IPV6_RECVRTHDRDSTOPTS is NOT
                  * (and WILL NOT be) defined because
                  * IPV6_RECVDSTOPTS is more generic. --yoshfuji
                  */
@@ -512,15 +512,15 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         continue;
 
                 switch (cmsg->cmsg_type) {
-                case IPV6_PKTINFO:
-                case IPV6_2292PKTINFO:
-                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct in6_pktinfo))) {
+                case IPV6_PKTINFO:
+                case IPV6_2292PKTINFO:
+                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct in6_pktinfo))) {
                                 err = -EINVAL;
                                 goto exit_f;
                         }
 
                         src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg);
-                        
+
                         if (src_info->ipi6_ifindex) {
                                 if (fl->oif && src_info->ipi6_ifindex != fl->oif)
                                         return -EINVAL;
@@ -531,7 +531,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
 
                         if (addr_type == IPV6_ADDR_ANY)
                                 break;
-                        
+
                         if (addr_type & IPV6_ADDR_LINKLOCAL) {
                                 if (!src_info->ipi6_ifindex)
                                         return -EINVAL;
@@ -554,7 +554,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         break;
 
                 case IPV6_FLOWINFO:
-                        if (cmsg->cmsg_len < CMSG_LEN(4)) {
+                        if (cmsg->cmsg_len < CMSG_LEN(4)) {
                                 err = -EINVAL;
                                 goto exit_f;
                         }
@@ -570,7 +570,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
 
                 case IPV6_2292HOPOPTS:
                 case IPV6_HOPOPTS:
-                        if (opt->hopopt || cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
+                        if (opt->hopopt || cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
                                 err = -EINVAL;
                                 goto exit_f;
                         }
@@ -590,7 +590,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         break;
 
                 case IPV6_2292DSTOPTS:
-                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
+                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
                                 err = -EINVAL;
                                 goto exit_f;
                         }
@@ -641,7 +641,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
 
                 case IPV6_2292RTHDR:
                 case IPV6_RTHDR:
-                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_rt_hdr))) {
+                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_rt_hdr))) {
                                 err = -EINVAL;
                                 goto exit_f;
                         }
@@ -661,7 +661,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
 
                         len = ((rthdr->hdrlen + 1) << 3);
 
-                        if (cmsg->cmsg_len < CMSG_LEN(len)) {
+                        if (cmsg->cmsg_len < CMSG_LEN(len)) {
                                 err = -EINVAL;
                                 goto exit_f;
                         }
@@ -716,7 +716,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                     }
                 default:
                         LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
-                                       cmsg->cmsg_type);
+                                       cmsg->cmsg_type);
                         err = -EINVAL;
                         break;
                 };
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 25dcf69cd807..363e63ffecca 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -1,26 +1,26 @@
 /*
  * Copyright (C)2002 USAGI/WIDE Project
- * 
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
  * Authors
  *
- *      Mitsuru KANDA @USAGI       : IPv6 Support 
+ *      Mitsuru KANDA @USAGI       : IPv6 Support
  *      Kazunori MIYAZAWA @USAGI   :
  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
- *      
+ *
  *      This file is derived from net/ipv4/esp.c
  */
 
@@ -166,7 +166,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
         }
 
         /* If integrity check is required, do this. */
-        if (esp->auth.icv_full_len) {
+        if (esp->auth.icv_full_len) {
                 u8 sum[alen];
 
                 ret = esp_mac_digest(esp, skb, 0, skb->len - alen);
@@ -197,7 +197,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
         if (esp->conf.ivlen)
                 crypto_blkcipher_set_iv(tfm, esph->enc_data, esp->conf.ivlen);
 
-        {
+        {
                 u8 nexthdr[2];
                 struct scatterlist *sg = &esp->sgbuf[0];
                 u8 padlen;
@@ -225,7 +225,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
                         ret = -EINVAL;
                         goto out;
                 }
-                /* ... check padding bits here. Silly. :-) */ 
+                /* ... check padding bits here. Silly. :-) */
 
                 pskb_trim(skb, skb->len - alen - padlen - 2);
                 ret = nexthdr[1];
@@ -256,20 +256,20 @@ static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                     int type, int code, int offset, __be32 info)
+                     int type, int code, int offset, __be32 info)
 {
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
         struct ipv6_esp_hdr *esph = (struct ipv6_esp_hdr*)(skb->data+offset);
         struct xfrm_state *x;
 
-        if (type != ICMPV6_DEST_UNREACH && 
+        if (type != ICMPV6_DEST_UNREACH &&
             type != ICMPV6_PKT_TOOBIG)
                 return;
 
         x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
         if (!x)
                 return;
-        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/" NIP6_FMT "\n", 
+        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/" NIP6_FMT "\n",
                         ntohl(esph->spi), NIP6(iph->daddr));
         xfrm_state_put(x);
 }
@@ -326,10 +326,10 @@ static int esp6_init_state(struct xfrm_state *x)
                 esp->auth.tfm = hash;
                 if (crypto_hash_setkey(hash, esp->auth.key, esp->auth.key_len))
                         goto error;
- 
+
                 aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
                 BUG_ON(!aalg_desc);
- 
+
                 if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
                     crypto_hash_digestsize(hash)) {
                         NETDEBUG(KERN_INFO "ESP: %s digestsize %u != %hu\n",
@@ -338,10 +338,10 @@ static int esp6_init_state(struct xfrm_state *x)
                                  aalg_desc->uinfo.auth.icv_fullbits/8);
                         goto error;
                 }
- 
+
                 esp->auth.icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
                 esp->auth.icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
- 
+
                 esp->auth.work_icv = kmalloc(esp->auth.icv_full_len, GFP_KERNEL);
                 if (!esp->auth.work_icv)
                         goto error;
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 0711f92d6a12..08313efc48c8 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -16,7 +16,7 @@
  */
 
 /* Changes:
- *      yoshfuji                : ensure not to overrun while parsing 
+ *      yoshfuji                : ensure not to overrun while parsing
  *                                tlv options.
  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
@@ -167,8 +167,8 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff **skbp)
                                 goto bad;
                         for (curr=procs; curr->type >= 0; curr++) {
                                 if (curr->type == skb->nh.raw[off]) {
-                                        /* type specific length/alignment 
-                                           checks will be performed in the 
+                                        /* type specific length/alignment
+                                           checks will be performed in the
                                            func(). */
                                         if (curr->func(skbp, off) == 0)
                                                 return 0;
@@ -572,7 +572,7 @@ void __init ipv6_rthdr_init(void)
    For now we need to test the engine, so that I created
    temporary (or permanent) backdoor.
    If listening socket set IPV6_RTHDR to 2, then we invert header.
-                                                   --ANK (980729)
+                                                   --ANK (980729)
  */
 
 struct ipv6_txoptions *
@@ -635,7 +635,7 @@ static int ipv6_hop_ra(struct sk_buff **skbp, int optoff)
                 return 1;
         }
         LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
-                       skb->nh.raw[optoff+1]);
+                       skb->nh.raw[optoff+1]);
         kfree_skb(skb);
         return 0;
 }
@@ -649,7 +649,7 @@ static int ipv6_hop_jumbo(struct sk_buff **skbp, int optoff)
 
         if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
                 LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
-                               skb->nh.raw[optoff+1]);
+                               skb->nh.raw[optoff+1]);
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
                 goto drop;
@@ -740,7 +740,7 @@ static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
         int hops;
 
         ihdr = (struct rt0_hdr *) opt;
-        
+
         phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 21cbbbddaf4d..e1caa5d526c2 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -4,13 +4,13 @@
  */
 #include <net/ipv6.h>
 
-/* 
+/*
  * find out if nexthdr is a well-known extension header or a protocol
  */
 
 int ipv6_ext_hdr(u8 nexthdr)
 {
-        /* 
+        /*
          * find out if nexthdr is an extension header or a protocol
          */
         return ( (nexthdr == NEXTHDR_HOP)       ||
@@ -25,18 +25,18 @@ int ipv6_ext_hdr(u8 nexthdr)
  * Skip any extension headers. This is used by the ICMP module.
  *
  * Note that strictly speaking this conflicts with RFC 2460 4.0:
- * ...The contents and semantics of each extension header determine whether 
+ * ...The contents and semantics of each extension header determine whether
  * or not to proceed to the next header.  Therefore, extension headers must
  * be processed strictly in the order they appear in the packet; a
  * receiver must not, for example, scan through a packet looking for a
  * particular kind of extension header and process that header prior to
  * processing all preceding ones.
- * 
+ *
  * We do exactly this. This is a protocol bug. We can't decide after a
- * seeing an unknown discard-with-error flavour TLV option if it's a 
+ * seeing an unknown discard-with-error flavour TLV option if it's a
  * ICMP error message or not (errors should never be send in reply to
  * ICMP error messages).
- * 
+ *
  * But I see no other way to do this. This might need to be reexamined
  * when Linux implements ESP (and maybe AUTH) headers.
  * --AK
@@ -90,9 +90,9 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp)
                                 break;
                         hdrlen = 8;
                 } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2; 
+                        hdrlen = (hp->hdrlen+2)<<2;
                 else
-                        hdrlen = ipv6_optlen(hp); 
+                        hdrlen = ipv6_optlen(hp);
 
                 nexthdr = hp->nexthdr;
                 start += hdrlen;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 3dcc4b7f41b4..9377fea02682 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -107,7 +107,7 @@ static __inline__ void icmpv6_xmit_unlock(void)
         spin_unlock_bh(&icmpv6_socket->sk->sk_lock.slock);
 }
 
-/* 
+/*
  * Slightly more convenient version of icmpv6_send.
  */
 void icmpv6_param_prob(struct sk_buff *skb, int code, int pos)
@@ -153,8 +153,8 @@ static int is_ineligible(struct sk_buff *skb)
 
 static int sysctl_icmpv6_time __read_mostly = 1*HZ;
 
-/* 
- * Check the ICMP output rate limit 
+/*
+ * Check the ICMP output rate limit
  */
 static inline int icmpv6_xrlim_allow(struct sock *sk, int type,
                                      struct flowi *fl)
@@ -170,7 +170,7 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, int type,
         if (type == ICMPV6_PKT_TOOBIG)
                 return 1;
 
-        /* 
+        /*
          * Look up the output route.
          * XXX: perhaps the expire for routing entries cloned by
          * this lookup should be more aggressive (not longer than timeout).
@@ -198,7 +198,7 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, int type,
 /*
  *      an inline helper for the "simple" if statement below
  *      checks if parameter problem report is caused by an
- *      unrecognized IPv6 option that has the Option Type 
+ *      unrecognized IPv6 option that has the Option Type
  *      highest-order two bits set to 10
  */
 
@@ -298,7 +298,7 @@ static inline void mip6_addr_swap(struct sk_buff *skb) {}
 /*
  *      Send an ICMP message in response to a packet in error
  */
-void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info, 
+void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
                  struct net_device *dev)
 {
         struct inet6_dev *idev = NULL;
@@ -320,7 +320,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
                 return;
 
         /*
-         *      Make sure we respect the rules 
+         *      Make sure we respect the rules
          *      i.e. RFC 1885 2.4(e)
          *      Rule (e.1) is enforced by not using icmpv6_send
          *      in any code that processes icmp errors.
@@ -336,8 +336,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
 
         if ((addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST)) {
                 if (type != ICMPV6_PKT_TOOBIG &&
-                    !(type == ICMPV6_PARAMPROB && 
-                      code == ICMPV6_UNK_OPTION && 
+                    !(type == ICMPV6_PARAMPROB &&
+                      code == ICMPV6_UNK_OPTION &&
                       (opt_unrec(skb, info))))
                         return;
 
@@ -364,7 +364,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
                 return;
         }
 
-        /* 
+        /*
          *      Never answer to a ICMP packet.
          */
         if (is_ineligible(skb)) {
@@ -543,14 +543,14 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         }
         err = icmpv6_push_pending_frames(sk, &fl, &tmp_hdr, skb->len + sizeof(struct icmp6hdr));
 
-        ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTECHOREPLIES);
-        ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTMSGS);
+        ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTECHOREPLIES);
+        ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTMSGS);
 
-out_put: 
+out_put:
         if (likely(idev != NULL))
                 in6_dev_put(idev);
         dst_release(dst);
-out: 
+out:
         icmpv6_xmit_unlock();
 }
 
@@ -608,7 +608,7 @@ static void icmpv6_notify(struct sk_buff *skb, int type, int code, __be32 info)
         }
         read_unlock(&raw_v6_lock);
 }
-  
+
 /*
  *      Handle icmp messages
  */
@@ -722,9 +722,9 @@ static int icmpv6_rcv(struct sk_buff **pskb)
                 if (type & ICMPV6_INFOMSG_MASK)
                         break;
 
-                /* 
-                 * error of unknown type. 
-                 * must pass to upper level 
+                /*
+                 * error of unknown type.
+                 * must pass to upper level
                  */
 
                 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
@@ -852,7 +852,7 @@ int icmpv6_err_convert(int type, int code, int *err)
         case ICMPV6_PKT_TOOBIG:
                 *err = EMSGSIZE;
                 break;
-                
+
         case ICMPV6_PARAMPROB:
                 *err = EPROTO;
                 fatal = 1;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index b7e5bae0e347..30b16da739c2 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -79,7 +79,7 @@ struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
                         goto hit; /* You sunk my battleship! */
         }
         /* Must check for a TIME_WAIT'er before going to listener hash. */
-        sk_for_each(sk, node, &(head + hashinfo->ehash_size)->chain) {
+        sk_for_each(sk, node, &head->twchain) {
                 const struct inet_timewait_sock *tw = inet_twsk(sk);
 
                 if(*((__portpair *)&(tw->tw_dport))     == ports        &&
@@ -115,7 +115,7 @@ struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
         sk_for_each(sk, node, &hashinfo->listening_hash[inet_lhashfn(hnum)]) {
                 if (inet_sk(sk)->num == hnum && sk->sk_family == PF_INET6) {
                         const struct ipv6_pinfo *np = inet6_sk(sk);
-                        
+
                         score = 1;
                         if (!ipv6_addr_any(&np->rcv_saddr)) {
                                 if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
@@ -183,7 +183,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         write_lock(&head->lock);
 
         /* Check TIME-WAIT sockets first. */
-        sk_for_each(sk2, node, &(head + hinfo->ehash_size)->chain) {
+        sk_for_each(sk2, node, &head->twchain) {
                 const struct inet6_timewait_sock *tw6 = inet6_twsk(sk2);
 
                 tw = inet_twsk(sk2);
@@ -249,81 +249,81 @@ int inet6_hash_connect(struct inet_timewait_death_row *death_row,
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
         const unsigned short snum = inet_sk(sk)->num;
-        struct inet_bind_hashbucket *head;
-        struct inet_bind_bucket *tb;
+        struct inet_bind_hashbucket *head;
+        struct inet_bind_bucket *tb;
         int ret;
 
-        if (snum == 0) {
-                const int low = sysctl_local_port_range[0];
-                const int high = sysctl_local_port_range[1];
+        if (snum == 0) {
+                const int low = sysctl_local_port_range[0];
+                const int high = sysctl_local_port_range[1];
                 const int range = high - low;
-                int i, port;
+                int i, port;
                 static u32 hint;
                 const u32 offset = hint + inet6_sk_port_offset(sk);
                 struct hlist_node *node;
-                struct inet_timewait_sock *tw = NULL;
+                struct inet_timewait_sock *tw = NULL;
 
-                local_bh_disable();
+                local_bh_disable();
                 for (i = 1; i <= range; i++) {
                         port = low + (i + offset) % range;
-                        head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)];
-                        spin_lock(&head->lock);
+                        head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)];
+                        spin_lock(&head->lock);
 
-                        /* Does not bother with rcv_saddr checks,
-                         * because the established check is already
-                         * unique enough.
-                         */
+                        /* Does not bother with rcv_saddr checks,
+                         * because the established check is already
+                         * unique enough.
+                         */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
-                                if (tb->port == port) {
-                                        BUG_TRAP(!hlist_empty(&tb->owners));
-                                        if (tb->fastreuse >= 0)
-                                                goto next_port;
-                                        if (!__inet6_check_established(death_row,
+                                if (tb->port == port) {
+                                        BUG_TRAP(!hlist_empty(&tb->owners));
+                                        if (tb->fastreuse >= 0)
+                                                goto next_port;
+                                        if (!__inet6_check_established(death_row,
                                                                        sk, port,
                                                                        &tw))
-                                                goto ok;
-                                        goto next_port;
-                                }
-                        }
+                                                goto ok;
+                                        goto next_port;
+                                }
+                        }
 
-                        tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep,
+                        tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep,
                                                      head, port);
-                        if (!tb) {
-                                spin_unlock(&head->lock);
-                                break;
-                        }
-                        tb->fastreuse = -1;
-                        goto ok;
+                        if (!tb) {
+                                spin_unlock(&head->lock);
+                                break;
+                        }
+                        tb->fastreuse = -1;
+                        goto ok;
 
-                next_port:
-                        spin_unlock(&head->lock);
-                }
-                local_bh_enable();
+                next_port:
+                        spin_unlock(&head->lock);
+                }
+                local_bh_enable();
 
-                return -EADDRNOTAVAIL;
+                return -EADDRNOTAVAIL;
 
 ok:
                 hint += i;
 
-                /* Head lock still held and bh's disabled */
-                inet_bind_hash(sk, tb, port);
+                /* Head lock still held and bh's disabled */
+                inet_bind_hash(sk, tb, port);
                 if (sk_unhashed(sk)) {
-                        inet_sk(sk)->sport = htons(port);
-                        __inet6_hash(hinfo, sk);
-                }
-                spin_unlock(&head->lock);
+                        inet_sk(sk)->sport = htons(port);
+                        __inet6_hash(hinfo, sk);
+                }
+                spin_unlock(&head->lock);
 
-                if (tw) {
-                        inet_twsk_deschedule(tw, death_row);
-                        inet_twsk_put(tw);
-                }
+                if (tw) {
+                        inet_twsk_deschedule(tw, death_row);
+                        inet_twsk_put(tw);
+                }
 
                 ret = 0;
                 goto out;
-        }
+        }
 
-        head = &hinfo->bhash[inet_bhashfn(snum, hinfo->bhash_size)];
-        tb   = inet_csk(sk)->icsk_bind_hash;
+        head = &hinfo->bhash[inet_bhashfn(snum, hinfo->bhash_size)];
+        tb   = inet_csk(sk)->icsk_bind_hash;
         spin_lock_bh(&head->lock);
 
         if (sk_head(&tb->owners) == sk && sk->sk_bind_node.next == NULL) {
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 96d8310ae9c8..f4d7be77eb0f 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1,9 +1,9 @@
 /*
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *      Forwarding Information Database
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      $Id: ip6_fib.c,v 1.25 2001/10/31 21:55:55 davem Exp $
  *
@@ -97,7 +97,7 @@ static DEFINE_TIMER(ip6_fib_timer, fib6_run_gc, 0, 0);
 
 static struct fib6_walker_t fib6_walker_list = {
         .prev   = &fib6_walker_list,
-        .next   = &fib6_walker_list, 
+        .next   = &fib6_walker_list,
 };
 
 #define FOR_WALKERS(w) for ((w)=fib6_walker_list.next; (w) != &fib6_walker_list; (w)=(w)->next)
@@ -131,7 +131,7 @@ static __inline__ u32 fib6_new_sernum(void)
 /*
  *      Auxiliary address test functions for the radix tree.
  *
- *      These assume a 32bit processor (although it will work on 
+ *      These assume a 32bit processor (although it will work on
  *      64bit processors)
  */
 
@@ -150,8 +150,7 @@ static __inline__ struct fib6_node * node_alloc(void)
 {
         struct fib6_node *fn;
 
-        if ((fn = kmem_cache_alloc(fib6_node_kmem, GFP_ATOMIC)) != NULL)
-                memset(fn, 0, sizeof(struct fib6_node));
+        fn = kmem_cache_zalloc(fib6_node_kmem, GFP_ATOMIC);
 
         return fn;
 }
@@ -298,7 +297,7 @@ static int fib6_dump_node(struct fib6_walker_t *w)
         int res;
         struct rt6_info *rt;
 
-        for (rt = w->leaf; rt; rt = rt->u.next) {
+        for (rt = w->leaf; rt; rt = rt->u.dst.rt6_next) {
                 res = rt6_dump_route(rt, w->args);
                 if (res < 0) {
                         /* Frame is full, suspend walking */
@@ -434,7 +433,7 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
         struct fib6_node *pn = NULL;
         struct rt6key *key;
         int     bit;
-        __be32  dir = 0;
+        __be32  dir = 0;
         __u32   sernum = fib6_new_sernum();
 
         RT6_TRACE("fib6_add_1\n");
@@ -452,27 +451,27 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
                 if (plen < fn->fn_bit ||
                     !ipv6_prefix_equal(&key->addr, addr, fn->fn_bit))
                         goto insert_above;
-                
+
                 /*
                  *      Exact match ?
                  */
-                         
+
                 if (plen == fn->fn_bit) {
                         /* clean up an intermediate node */
                         if ((fn->fn_flags & RTN_RTINFO) == 0) {
                                 rt6_release(fn->leaf);
                                 fn->leaf = NULL;
                         }
-                        
+
                         fn->fn_sernum = sernum;
-                                
+
                         return fn;
                 }
 
                 /*
                  *      We have more bits to go
                  */
-                         
+
                 /* Try to walk down on tree. */
                 fn->fn_sernum = sernum;
                 dir = addr_bit_set(addr, fn->fn_bit);
@@ -490,7 +489,7 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
         if (ln == NULL)
                 return NULL;
         ln->fn_bit = plen;
-                        
+
         ln->parent = pn;
         ln->fn_sernum = sernum;
 
@@ -504,7 +503,7 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
 
 insert_above:
         /*
-         * split since we don't have a common prefix anymore or 
+         * split since we don't have a common prefix anymore or
          * we have a less significant route.
          * we've to insert an intermediate node on the list
          * this new node will point to the one we need to create
@@ -518,18 +517,18 @@ insert_above:
            See comment in __ipv6_addr_diff: bit may be an invalid value,
            but if it is >= plen, the value is ignored in any case.
          */
-        
+
         bit = __ipv6_addr_diff(addr, &key->addr, addrlen);
 
-        /* 
-         *              (intermediate)[in]      
+        /*
+         *              (intermediate)[in]
          *                /        \
          *      (new leaf node)[ln] (old node)[fn]
          */
         if (plen > bit) {
                 in = node_alloc();
                 ln = node_alloc();
-                
+
                 if (in == NULL || ln == NULL) {
                         if (in)
                                 node_free(in);
@@ -538,8 +537,8 @@ insert_above:
                         return NULL;
                 }
 
-                /* 
-                 * new intermediate node. 
+                /*
+                 * new intermediate node.
                  * RTN_RTINFO will
                  * be off since that an address that chooses one of
                  * the branches would not match less specific routes
@@ -576,7 +575,7 @@ insert_above:
                 }
         } else { /* plen <= bit */
 
-                /* 
+                /*
                  *              (new leaf node)[ln]
                  *                /        \
                  *           (old node)[fn] NULL
@@ -592,7 +591,7 @@ insert_above:
                 ln->parent = pn;
 
                 ln->fn_sernum = sernum;
-                
+
                 if (dir)
                         pn->right = ln;
                 else
@@ -624,11 +623,11 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
             fn->leaf == &ip6_null_entry &&
             !(rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ){
                 fn->leaf = rt;
-                rt->u.next = NULL;
+                rt->u.dst.rt6_next = NULL;
                 goto out;
         }
 
-        for (iter = fn->leaf; iter; iter=iter->u.next) {
+        for (iter = fn->leaf; iter; iter=iter->u.dst.rt6_next) {
                 /*
                  *      Search for duplicates
                  */
@@ -656,7 +655,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                 if (iter->rt6i_metric > rt->rt6i_metric)
                         break;
 
-                ins = &iter->u.next;
+                ins = &iter->u.dst.rt6_next;
         }
 
         /*
@@ -664,7 +663,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
          */
 
 out:
-        rt->u.next = iter;
+        rt->u.dst.rt6_next = iter;
         *ins = rt;
         rt->rt6i_node = fn;
         atomic_inc(&rt->rt6i_ref);
@@ -1105,7 +1104,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         RT6_TRACE("fib6_del_route\n");
 
         /* Unlink it */
-        *rtp = rt->u.next;
+        *rtp = rt->u.dst.rt6_next;
         rt->rt6i_node = NULL;
         rt6_stats.fib_rt_entries--;
         rt6_stats.fib_discarded_routes++;
@@ -1115,14 +1114,14 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         FOR_WALKERS(w) {
                 if (w->state == FWS_C && w->leaf == rt) {
                         RT6_TRACE("walker %p adjusted by delroute\n", w);
-                        w->leaf = rt->u.next;
+                        w->leaf = rt->u.dst.rt6_next;
                         if (w->leaf == NULL)
                                 w->state = FWS_U;
                 }
         }
         read_unlock(&fib6_walker_lock);
 
-        rt->u.next = NULL;
+        rt->u.dst.rt6_next = NULL;
 
         if (fn->leaf == NULL && fn->fn_flags&RTN_TL_ROOT)
                 fn->leaf = &ip6_null_entry;
@@ -1190,7 +1189,7 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
          *      Walk the leaf entries looking for ourself
          */
 
-        for (rtp = &fn->leaf; *rtp; rtp = &(*rtp)->u.next) {
+        for (rtp = &fn->leaf; *rtp; rtp = &(*rtp)->u.dst.rt6_next) {
                 if (*rtp == rt) {
                         fib6_del_route(fn, rtp, info);
                         return 0;
@@ -1206,7 +1205,7 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
  *      However, it is internally reenterable wrt itself and fib6_add/fib6_del.
  *      It means, that we can modify tree during walking
  *      and use this function for garbage collection, clone pruning,
- *      cleaning tree when a device goes down etc. etc. 
+ *      cleaning tree when a device goes down etc. etc.
  *
  *      It guarantees that every node will be traversed,
  *      and that it will be traversed only once.
@@ -1245,7 +1244,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                                 continue;
                         }
                         w->state = FWS_L;
-#endif  
+#endif
                 case FWS_L:
                         if (fn->left) {
                                 w->node = fn->left;
@@ -1317,7 +1316,7 @@ static int fib6_clean_node(struct fib6_walker_t *w)
         struct rt6_info *rt;
         struct fib6_cleaner_t *c = (struct fib6_cleaner_t*)w;
 
-        for (rt = w->leaf; rt; rt = rt->u.next) {
+        for (rt = w->leaf; rt; rt = rt->u.dst.rt6_next) {
                 res = c->func(rt, c->arg);
                 if (res < 0) {
                         w->leaf = rt;
@@ -1338,7 +1337,7 @@ static int fib6_clean_node(struct fib6_walker_t *w)
 
 /*
  *      Convenient frontend to tree walker.
- *      
+ *
  *      func is called on each route.
  *              It may return -1 -> delete this route.
  *                            0  -> continue walking
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 624fae251f4e..c206a152ed9d 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -228,10 +228,10 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
                                          struct ipv6_txoptions * fopt)
 {
         struct ipv6_txoptions * fl_opt = fl->opt;
-        
+
         if (fopt == NULL || fopt->opt_flen == 0)
                 return fl_opt;
-        
+
         if (fl_opt != NULL) {
                 opt_space->hopopt = fl_opt->hopopt;
                 opt_space->dst0opt = fl_opt->dst0opt;
@@ -677,7 +677,7 @@ out_kfree:
         goto out;
 }
 
-static struct file_operations ip6fl_seq_fops = {
+static const struct file_operations ip6fl_seq_fops = {
         .owner          =       THIS_MODULE,
         .open           =       ip6fl_seq_open,
         .read           =       seq_read,
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index ad0b8abcdf4b..4fdded0e545a 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -1,6 +1,6 @@
 /*
  *      IPv6 input
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
  *      Pedro Roque             <roque@di.fc.ul.pt>
@@ -48,7 +48,7 @@
 
 
 
-inline int ip6_rcv_finish( struct sk_buff *skb) 
+inline int ip6_rcv_finish( struct sk_buff *skb)
 {
         if (skb->dst == NULL)
                 ip6_route_input(skb);
@@ -173,9 +173,9 @@ resubmit:
         hash = nexthdr & (MAX_INET_PROTOS - 1);
         if ((ipprot = rcu_dereference(inet6_protos[hash])) != NULL) {
                 int ret;
-                
+
                 if (ipprot->flags & INET6_PROTO_FINAL) {
-                        struct ipv6hdr *hdr;    
+                        struct ipv6hdr *hdr;
 
                         /* Free reference early: we don't need it any more,
                            and it may hold ip_conntrack module loaded
@@ -192,9 +192,9 @@ resubmit:
                                 goto discard;
                 }
                 if (!(ipprot->flags & INET6_PROTO_NOPOLICY) &&
-                    !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) 
+                    !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
                         goto discard;
-                
+
                 ret = ipprot->handler(&skb);
                 if (ret > 0)
                         goto resubmit;
@@ -205,8 +205,8 @@ resubmit:
                         if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                                 IP6_INC_STATS_BH(idev, IPSTATS_MIB_INUNKNOWNPROTOS);
                                 icmpv6_send(skb, ICMPV6_PARAMPROB,
-                                            ICMPV6_UNK_NEXTHDR, nhoff,
-                                            skb->dev);
+                                            ICMPV6_UNK_NEXTHDR, nhoff,
+                                            skb->dev);
                         }
                 } else
                         IP6_INC_STATS_BH(idev, IPSTATS_MIB_INDELIVERS);
@@ -253,7 +253,7 @@ int ip6_mc_input(struct sk_buff *skb)
                         struct dst_entry *dst;
 
                         dst = skb->dst;
-                        
+
                         if (deliver) {
                                 skb2 = skb_clone(skb, GFP_ATOMIC);
                                 dst_output(skb2);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7b7bd44fbf47..305516921aa8 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1,9 +1,9 @@
 /*
  *      IPv6 output functions
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      $Id: ip6_output.c,v 1.34 2002/02/01 22:01:04 davem Exp $
  *
@@ -363,7 +363,7 @@ int ip6_forward(struct sk_buff *skb)
         struct dst_entry *dst = skb->dst;
         struct ipv6hdr *hdr = skb->nh.ipv6h;
         struct inet6_skb_parm *opt = IP6CB(skb);
-        
+
         if (ipv6_devconf.forwarding == 0)
                 goto error;
 
@@ -473,7 +473,7 @@ int ip6_forward(struct sk_buff *skb)
         hdr = skb->nh.ipv6h;
 
         /* Mangling hops number delayed to point after skb COW */
- 
+
         hdr->hop_limit--;
 
         IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
@@ -659,7 +659,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                                 frag->nh.ipv6h->payload_len = htons(frag->len - sizeof(struct ipv6hdr));
                                 ip6_copy_metadata(frag, skb);
                         }
-                        
+
                         err = output(skb);
                         if(!err)
                                 IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGCREATES);
@@ -792,7 +792,7 @@ slow_path:
 fail:
         IP6_INC_STATS(ip6_dst_idev(skb->dst),
                       IPSTATS_MIB_FRAGFAILS);
-        kfree_skb(skb); 
+        kfree_skb(skb);
         return err;
 }
 
@@ -955,7 +955,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                 struct frag_hdr fhdr;
 
                 /* specify the length of each IP datagram fragment*/
-                skb_shinfo(skb)->gso_size = mtu - fragheaderlen - 
+                skb_shinfo(skb)->gso_size = mtu - fragheaderlen -
                                             sizeof(struct frag_hdr);
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                 ipv6_select_ident(skb, &fhdr);
@@ -1058,13 +1058,13 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
          * fragment alignment (= 8-15 octects, in total).
          *
          * Note that we may need to "move" the data from the tail of
-         * of the buffer to the new fragment when we split 
+         * of the buffer to the new fragment when we split
          * the message.
          *
-         * FIXME: It may be fragmented into multiple chunks 
+         * FIXME: It may be fragmented into multiple chunks
          *        at once if non-fragmentable extension headers
          *        are too large.
-         * --yoshfuji 
+         * --yoshfuji
          */
 
         inet->cork.length += length;
@@ -1129,7 +1129,7 @@ alloc_new_skb:
 
                         /*
                          * We just reserve space for fragment header.
-                         * Note: this may be overallocation if the message 
+                         * Note: this may be overallocation if the message
                          * (without MSG_MORE) fits into the MTU.
                          */
                         alloclen += sizeof(struct frag_hdr);
@@ -1310,7 +1310,7 @@ int ip6_push_pending_frames(struct sock *sk)
                 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
 
         skb->nh.ipv6h = hdr = (struct ipv6hdr*) skb_push(skb, sizeof(struct ipv6hdr));
-        
+
         *(__be32*)hdr = fl->fl6_flowlabel |
                      htonl(0x60000000 | ((int)np->cork.tclass << 20));
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 8d918348f5bb..367b74832986 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -3,7 +3,7 @@
  *      Linux INET6 implementation
  *
  *      Authors:
- *      Ville Nuorvala          <vnuorval@tcs.hut.fi>   
+ *      Ville Nuorvala          <vnuorval@tcs.hut.fi>
  *
  *      $Id$
  *
@@ -67,8 +67,8 @@ MODULE_LICENSE("GPL");
 #define HASH_SIZE  32
 
 #define HASH(addr) ((__force u32)((addr)->s6_addr32[0] ^ (addr)->s6_addr32[1] ^ \
-                     (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
-                    (HASH_SIZE - 1))
+                     (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
+                    (HASH_SIZE - 1))
 
 static int ip6ip6_fb_tnl_dev_init(struct net_device *dev);
 static int ip6ip6_tnl_dev_init(struct net_device *dev);
@@ -90,7 +90,7 @@ static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
         struct dst_entry *dst = t->dst_cache;
 
-        if (dst && dst->obsolete && 
+        if (dst && dst->obsolete &&
             dst->ops->check(dst, t->dst_cookie) == NULL) {
                 t->dst_cache = NULL;
                 dst_release(dst);
@@ -116,12 +116,12 @@ static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
 
 /**
  * ip6ip6_tnl_lookup - fetch tunnel matching the end-point addresses
- *   @remote: the address of the tunnel exit-point 
- *   @local: the address of the tunnel entry-point 
+ *   @remote: the address of the tunnel exit-point
+ *   @local: the address of the tunnel entry-point
  *
- * Return:  
+ * Return:
  *   tunnel matching given end-points if found,
- *   else fallback tunnel if its device is up, 
+ *   else fallback tunnel if its device is up,
  *   else %NULL
  **/
 
@@ -146,13 +146,13 @@ ip6ip6_tnl_lookup(struct in6_addr *remote, struct in6_addr *local)
 
 /**
  * ip6ip6_bucket - get head of list matching given tunnel parameters
- *   @p: parameters containing tunnel end-points 
+ *   @p: parameters containing tunnel end-points
  *
  * Description:
- *   ip6ip6_bucket() returns the head of the list matching the 
+ *   ip6ip6_bucket() returns the head of the list matching the
  *   &struct in6_addr entries laddr and raddr in @p.
  *
- * Return: head of IPv6 tunnel list 
+ * Return: head of IPv6 tunnel list
  **/
 
 static struct ip6_tnl **
@@ -213,8 +213,8 @@ ip6ip6_tnl_unlink(struct ip6_tnl *t)
  *
  * Description:
  *   Create tunnel matching given parameters.
- * 
- * Return: 
+ *
+ * Return:
  *   created tunnel or NULL
  **/
 
@@ -234,7 +234,7 @@ static struct ip6_tnl *ip6_tnl_create(struct ip6_tnl_parm *p)
                         if (__dev_get_by_name(name) == NULL)
                                 break;
                 }
-                if (i == IP6_TNL_MAX) 
+                if (i == IP6_TNL_MAX)
                         goto failed;
         }
         dev = alloc_netdev(sizeof (*t), name, ip6ip6_tnl_dev_setup);
@@ -258,7 +258,7 @@ failed:
 
 /**
  * ip6ip6_tnl_locate - find or create tunnel matching given parameters
- *   @p: tunnel parameters 
+ *   @p: tunnel parameters
  *   @create: != 0 if allowed to create new tunnel if no match found
  *
  * Description:
@@ -289,7 +289,7 @@ static struct ip6_tnl *ip6ip6_tnl_locate(struct ip6_tnl_parm *p, int create)
 /**
  * ip6ip6_tnl_dev_uninit - tunnel device uninitializer
  *   @dev: the device to be destroyed
- *   
+ *
  * Description:
  *   ip6ip6_tnl_dev_uninit() removes tunnel from its list
  **/
@@ -314,8 +314,8 @@ ip6ip6_tnl_dev_uninit(struct net_device *dev)
  * parse_tvl_tnl_enc_lim - handle encapsulation limit option
  *   @skb: received socket buffer
  *
- * Return: 
- *   0 if none was found, 
+ * Return:
+ *   0 if none was found,
  *   else index to encapsulation limit
  **/
 
@@ -392,8 +392,8 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         __u16 len;
         int err = -ENOENT;
 
-        /* If the packet doesn't contain the original IPv6 header we are 
-           in trouble since we might need the source address for further 
+        /* If the packet doesn't contain the original IPv6 header we are
+           in trouble since we might need the source address for further
            processing of the error. */
 
         read_lock(&ip6ip6_lock);
@@ -418,7 +418,7 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         if (net_ratelimit())
                                 printk(KERN_WARNING
                                        "%s: Too small hop limit or "
-                                       "routing loop in tunnel!\n", 
+                                       "routing loop in tunnel!\n",
                                        t->parms.name);
                         rel_msg = 1;
                 }
@@ -502,7 +502,7 @@ static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
         int ret = 0;
 
         if (p->flags & IP6_TNL_F_CAP_RCV) {
-                struct net_device *ldev = NULL;
+                struct net_device *ldev = NULL;
 
                 if (p->link)
                         ldev = dev_get_by_index(p->link);
@@ -525,7 +525,7 @@ static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
  * Return: 0
  **/
 
-static int 
+static int
 ip6ip6_rcv(struct sk_buff *skb)
 {
         struct ipv6hdr *ipv6h;
@@ -595,13 +595,13 @@ static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
 /**
  * ip6ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
  *   @t: the outgoing tunnel device
- *   @hdr: IPv6 header from the incoming packet 
+ *   @hdr: IPv6 header from the incoming packet
  *
  * Description:
- *   Avoid trivial tunneling loop by checking that tunnel exit-point 
+ *   Avoid trivial tunneling loop by checking that tunnel exit-point
  *   doesn't match source of incoming packet.
  *
- * Return: 
+ * Return:
  *   1 if conflict,
  *   0 else
  **/
@@ -617,7 +617,7 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
         struct ip6_tnl_parm *p = &t->parms;
         int ret = 0;
 
-        if (p->flags & IP6_TNL_F_CAP_XMIT) {
+        if (p->flags & IP6_TNL_F_CAP_XMIT) {
                 struct net_device *ldev = NULL;
 
                 if (p->link)
@@ -641,19 +641,19 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
         return ret;
 }
 /**
- * ip6ip6_tnl_xmit - encapsulate packet and send 
+ * ip6ip6_tnl_xmit - encapsulate packet and send
  *   @skb: the outgoing socket buffer
- *   @dev: the outgoing tunnel device 
+ *   @dev: the outgoing tunnel device
  *
  * Description:
  *   Build new header and do some sanity checks on the packet before sending
  *   it.
  *
- * Return: 
+ * Return:
  *   0
  **/
 
-static int 
+static int
 ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
@@ -715,7 +715,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (tdev == dev) {
                 stats->collisions++;
                 if (net_ratelimit())
-                        printk(KERN_WARNING 
+                        printk(KERN_WARNING
                                "%s: Local routing loop detected!\n",
                                t->parms.name);
                 goto tx_err_dst_release;
@@ -741,11 +741,11 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
          * Okay, now see if we can stuff it in the buffer as-is.
          */
         max_headroom += LL_RESERVED_SPACE(tdev);
-        
-        if (skb_headroom(skb) < max_headroom || 
+
+        if (skb_headroom(skb) < max_headroom ||
             skb_cloned(skb) || skb_shared(skb)) {
                 struct sk_buff *new_skb;
-                
+
                 if (!(new_skb = skb_realloc_headroom(skb, max_headroom)))
                         goto tx_err_dst_release;
 
@@ -775,7 +775,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         ipv6_addr_copy(&ipv6h->daddr, &fl.fl6_dst);
         nf_reset(skb);
         pkt_len = skb->len;
-        err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, 
+        err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL,
                       skb->dst->dev, dst_output);
 
         if (net_xmit_eval(err) == 0) {
@@ -898,14 +898,14 @@ ip6ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
 }
 
 /**
- * ip6ip6_tnl_ioctl - configure ipv6 tunnels from userspace 
+ * ip6ip6_tnl_ioctl - configure ipv6 tunnels from userspace
  *   @dev: virtual device associated with tunnel
  *   @ifr: parameters passed from userspace
  *   @cmd: command to be performed
  *
  * Description:
- *   ip6ip6_tnl_ioctl() is used for managing IPv6 tunnels 
- *   from userspace. 
+ *   ip6ip6_tnl_ioctl() is used for managing IPv6 tunnels
+ *   from userspace.
  *
  *   The possible commands are the following:
  *     %SIOCGETTUNNEL: get tunnel parameters for device
@@ -913,7 +913,7 @@ ip6ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
  *     %SIOCCHGTUNNEL: change tunnel parameters to those given
  *     %SIOCDELTUNNEL: delete tunnel
  *
- *   The fallback device "ip6tnl0", created during module 
+ *   The fallback device "ip6tnl0", created during module
  *   initialization, can be used for creating other tunnel devices.
  *
  * Return:
@@ -999,7 +999,8 @@ ip6ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                                 break;
                         dev = t->dev;
                 }
-                err = unregister_netdevice(dev);
+                err = 0;
+                unregister_netdevice(dev);
                 break;
         default:
                 err = -EINVAL;
@@ -1008,7 +1009,7 @@ ip6ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 }
 
 /**
- * ip6ip6_tnl_get_stats - return the stats for tunnel device 
+ * ip6ip6_tnl_get_stats - return the stats for tunnel device
  *   @dev: virtual device associated with tunnel
  *
  * Return: stats for device
@@ -1101,7 +1102,7 @@ ip6ip6_tnl_dev_init(struct net_device *dev)
  * Return: 0
  **/
 
-static int 
+static int
 ip6ip6_fb_tnl_dev_init(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 511730b67e97..5724ba9f75de 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -9,25 +9,25 @@
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-/* 
+/*
  * [Memo]
  *
  * Outbound:
- *  The compression of IP datagram MUST be done before AH/ESP processing, 
- *  fragmentation, and the addition of Hop-by-Hop/Routing header. 
+ *  The compression of IP datagram MUST be done before AH/ESP processing,
+ *  fragmentation, and the addition of Hop-by-Hop/Routing header.
  *
  * Inbound:
- *  The decompression of IP datagram MUST be done after the reassembly, 
+ *  The decompression of IP datagram MUST be done after the reassembly,
  *  AH/ESP processing.
  */
 #include <linux/module.h>
@@ -176,7 +176,7 @@ out_ok:
 }
 
 static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                                int type, int code, int offset, __be32 info)
+                                int type, int code, int offset, __be32 info)
 {
         __be32 spi;
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
@@ -422,7 +422,7 @@ static int ipcomp6_init_state(struct xfrm_state *x)
         x->props.header_len = 0;
         if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct ipv6hdr);
-        
+
         mutex_lock(&ipcomp6_resource_mutex);
         if (!ipcomp6_alloc_scratches())
                 goto error;
@@ -455,7 +455,7 @@ error:
         goto out;
 }
 
-static struct xfrm_type ipcomp6_type = 
+static struct xfrm_type ipcomp6_type =
 {
         .description    = "IPCOMP6",
         .owner          = THIS_MODULE,
@@ -467,7 +467,7 @@ static struct xfrm_type ipcomp6_type =
         .hdr_offset     = xfrm6_find_1stfragopt,
 };
 
-static struct inet6_protocol ipcomp6_protocol = 
+static struct inet6_protocol ipcomp6_protocol =
 {
         .handler        = xfrm6_rcv,
         .err_handler    = ipcomp6_err,
@@ -490,7 +490,7 @@ static int __init ipcomp6_init(void)
 
 static void __exit ipcomp6_fini(void)
 {
-        if (inet6_del_protocol(&ipcomp6_protocol, IPPROTO_COMP) < 0) 
+        if (inet6_del_protocol(&ipcomp6_protocol, IPPROTO_COMP) < 0)
                 printk(KERN_INFO "ipv6 ipcomp close: can't remove protocol\n");
         if (xfrm_unregister_type(&ipcomp6_type, AF_INET6) < 0)
                 printk(KERN_INFO "ipv6 ipcomp close: can't remove xfrm type\n");
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 352690e2ab82..3f1e779ea5c5 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -1,9 +1,9 @@
 /*
  *      IPv6 BSD socket options interface
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      Based on linux/net/ipv4/ip_sockglue.c
  *
@@ -164,7 +164,7 @@ out:
 }
 
 static struct packet_type ipv6_packet_type = {
-        .type = __constant_htons(ETH_P_IPV6), 
+        .type = __constant_htons(ETH_P_IPV6),
         .func = ipv6_rcv,
         .gso_send_check = ipv6_gso_send_check,
         .gso_segment = ipv6_gso_segment,
@@ -320,7 +320,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 np->rxopt.bits.rxinfo = valbool;
                 retv = 0;
                 break;
-                
+
         case IPV6_2292PKTINFO:
                 np->rxopt.bits.rxoinfo = valbool;
                 retv = 0;
@@ -376,7 +376,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 np->tclass = val;
                 retv = 0;
                 break;
-                
+
         case IPV6_RECVTCLASS:
                 np->rxopt.bits.rxtclass = valbool;
                 retv = 0;
@@ -893,7 +893,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
         case IPV6_MTU:
         {
                 struct dst_entry *dst;
-                val = 0;        
+                val = 0;
                 lock_sock(sk);
                 dst = sk_dst_get(sk);
                 if (dst) {
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 882cde4b4047..a8d6625ec782 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1,13 +1,13 @@
 /*
  *      Multicast support for IPv6
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      $Id: mcast.c,v 1.40 2002/02/08 03:57:19 davem Exp $
  *
- *      Based on linux/ipv4/igmp.c and linux/ipv4/ip_sockglue.c 
+ *      Based on linux/ipv4/igmp.c and linux/ipv4/ip_sockglue.c
  *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
@@ -644,7 +644,7 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
                 memset(&ss, 0, sizeof(ss));
                 psin6->sin6_family = AF_INET6;
                 psin6->sin6_addr = psl->sl_addr[i];
-                if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss)))
+                if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss)))
                         return -EFAULT;
         }
         return 0;
@@ -1168,7 +1168,7 @@ int igmp6_event_query(struct sk_buff *skb)
 
         /* compute payload length excluding extension headers */
         len = ntohs(skb->nh.ipv6h->payload_len) + sizeof(struct ipv6hdr);
-        len -= (char *)skb->h.raw - (char *)skb->nh.ipv6h; 
+        len -= (char *)skb->h.raw - (char *)skb->nh.ipv6h;
 
         /* Drop queries with not link local source */
         if (!(ipv6_addr_type(&skb->nh.ipv6h->saddr)&IPV6_ADDR_LINKLOCAL))
@@ -1206,7 +1206,7 @@ int igmp6_event_query(struct sk_buff *skb)
                 /* clear deleted report items */
                 mld_clear_delrec(idev);
         } else if (len >= 28) {
-                int srcs_offset = sizeof(struct mld2_query) - 
+                int srcs_offset = sizeof(struct mld2_query) -
                                   sizeof(struct icmp6hdr);
                 if (!pskb_may_pull(skb, srcs_offset)) {
                         in6_dev_put(idev);
@@ -1230,7 +1230,7 @@ int igmp6_event_query(struct sk_buff *skb)
                 }
                 /* mark sources to include, if group & source-specific */
                 if (mlh2->nsrcs != 0) {
-                        if (!pskb_may_pull(skb, srcs_offset + 
+                        if (!pskb_may_pull(skb, srcs_offset +
                             ntohs(mlh2->nsrcs) * sizeof(struct in6_addr))) {
                                 in6_dev_put(idev);
                                 return -EINVAL;
@@ -1304,7 +1304,7 @@ int igmp6_event_report(struct sk_buff *skb)
 
         /* Drop reports with not link local source */
         addr_type = ipv6_addr_type(&skb->nh.ipv6h->saddr);
-        if (addr_type != IPV6_ADDR_ANY && 
+        if (addr_type != IPV6_ADDR_ANY &&
             !(addr_type&IPV6_ADDR_LINKLOCAL))
                 return -EINVAL;
 
@@ -1413,7 +1413,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
 
         if (ipv6_get_lladdr(dev, &addr_buf)) {
                 /* <draft-ietf-magma-mld-source-05.txt>:
-                 * use unspecified address as the source address 
+                 * use unspecified address as the source address
                  * when a valid link-local address is not available.
                  */
                 memset(&addr_buf, 0, sizeof(addr_buf));
@@ -1454,7 +1454,7 @@ static inline int mld_dev_queue_xmit2(struct sk_buff *skb)
 static inline int mld_dev_queue_xmit(struct sk_buff *skb)
 {
         return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dev,
-                       mld_dev_queue_xmit2);
+                       mld_dev_queue_xmit2);
 }
 
 static void mld_sendpack(struct sk_buff *skb)
@@ -1582,6 +1582,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                         skb = add_grhead(skb, pmc, type, &pgr);
                         first = 0;
                 }
+                if (!skb)
+                        return NULL;
                 psrc = (struct in6_addr *)skb_put(skb, sizeof(*psrc));
                 *psrc = psf->sf_addr;
                 scount++; stotal++;
@@ -1752,8 +1754,8 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 {
         struct sock *sk = igmp6_socket->sk;
         struct inet6_dev *idev;
-        struct sk_buff *skb;
-        struct icmp6hdr *hdr;
+        struct sk_buff *skb;
+        struct icmp6hdr *hdr;
         struct in6_addr *snd_addr;
         struct in6_addr *addrp;
         struct in6_addr addr_buf;
@@ -1791,7 +1793,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 
         if (ipv6_get_lladdr(dev, &addr_buf)) {
                 /* <draft-ietf-magma-mld-source-05.txt>:
-                 * use unspecified address as the source address 
+                 * use unspecified address as the source address
                  * when a valid link-local address is not available.
                  */
                 memset(&addr_buf, 0, sizeof(addr_buf));
@@ -2328,7 +2330,7 @@ static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
         struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
 
         for (state->dev = dev_base, state->idev = NULL;
-             state->dev; 
+             state->dev;
              state->dev = state->dev->next) {
                 struct inet6_dev *idev;
                 idev = in6_dev_get(state->dev);
@@ -2411,7 +2413,7 @@ static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
         struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
 
         seq_printf(seq,
-                   "%-4d %-15s " NIP6_SEQFMT " %5d %08X %ld\n", 
+                   "%-4d %-15s " NIP6_SEQFMT " %5d %08X %ld\n",
                    state->dev->ifindex, state->dev->name,
                    NIP6(im->mca_addr),
                    im->mca_users, im->mca_flags,
@@ -2449,7 +2451,7 @@ out_kfree:
         goto out;
 }
 
-static struct file_operations igmp6_mc_seq_fops = {
+static const struct file_operations igmp6_mc_seq_fops = {
         .owner          =       THIS_MODULE,
         .open           =       igmp6_mc_seq_open,
         .read           =       seq_read,
@@ -2472,7 +2474,7 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
         struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
 
         for (state->dev = dev_base, state->idev = NULL, state->im = NULL;
-             state->dev; 
+             state->dev;
              state->dev = state->dev->next) {
                 struct inet6_dev *idev;
                 idev = in6_dev_get(state->dev);
@@ -2577,7 +2579,7 @@ static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
         struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
 
         if (v == SEQ_START_TOKEN) {
-                seq_printf(seq, 
+                seq_printf(seq,
                            "%3s %6s "
                            "%32s %32s %6s %6s\n", "Idx",
                            "Device", "Multicast Address",
@@ -2606,7 +2608,7 @@ static int igmp6_mcf_seq_open(struct inode *inode, struct file *file)
         struct seq_file *seq;
         int rc = -ENOMEM;
         struct igmp6_mcf_iter_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
-        
+
         if (!s)
                 goto out;
 
@@ -2623,7 +2625,7 @@ out_kfree:
         goto out;
 }
 
-static struct file_operations igmp6_mcf_seq_fops = {
+static const struct file_operations igmp6_mcf_seq_fops = {
         .owner          =       THIS_MODULE,
         .open           =       igmp6_mcf_seq_open,
         .read           =       seq_read,
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index be7dd7db65d7..0afcabdd8ed6 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -89,7 +89,6 @@ static int mip6_mh_len(int type)
 int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
 {
         struct ip6_mh *mh;
-        int mhlen;
 
         if (!pskb_may_pull(skb, (skb->h.raw - skb->data) + 8) ||
             !pskb_may_pull(skb, (skb->h.raw - skb->data) + ((skb->h.raw[1] + 1) << 3)))
@@ -103,31 +102,6 @@ int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
                 mip6_param_prob(skb, 0, (&mh->ip6mh_hdrlen) - skb->nh.raw);
                 return -1;
         }
-        mhlen = (mh->ip6mh_hdrlen + 1) << 3;
-
-        if (skb->ip_summed == CHECKSUM_COMPLETE) {
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                if (csum_ipv6_magic(&skb->nh.ipv6h->saddr,
-                                    &skb->nh.ipv6h->daddr,
-                                    mhlen, IPPROTO_MH,
-                                    skb->csum)) {
-                        LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH hw checksum failed\n");
-                        skb->ip_summed = CHECKSUM_NONE;
-                }
-        }
-        if (skb->ip_summed == CHECKSUM_NONE) {
-                if (csum_ipv6_magic(&skb->nh.ipv6h->saddr,
-                                    &skb->nh.ipv6h->daddr,
-                                    mhlen, IPPROTO_MH,
-                                    skb_checksum(skb, 0, mhlen, 0))) {
-                        LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH checksum failed "
-                                       "[" NIP6_FMT " > " NIP6_FMT "]\n",
-                                       NIP6(skb->nh.ipv6h->saddr),
-                                       NIP6(skb->nh.ipv6h->daddr));
-                        return -1;
-                }
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-        }
 
         if (mh->ip6mh_proto != IPPROTO_NONE) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH invalid payload proto = %d\n",
@@ -359,7 +333,7 @@ static struct xfrm_type mip6_destopt_type =
         .destructor     = mip6_destopt_destroy,
         .input          = mip6_destopt_input,
         .output         = mip6_destopt_output,
-        .reject         = mip6_destopt_reject,
+        .reject         = mip6_destopt_reject,
         .hdr_offset     = mip6_destopt_offset,
         .local_addr     = mip6_xfrm_addr,
 };
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 39bb658f3c44..121f31c283f8 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1,9 +1,9 @@
 /*
  *      Neighbour Discovery for IPv6
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *      Mike Shaver             <shaver@ingenia.com>
  *
  *      This program is free software; you can redistribute it and/or
@@ -427,25 +427,25 @@ static inline void ndisc_flow_init(struct flowi *fl, u8 type,
 
 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                    struct in6_addr *daddr, struct in6_addr *solicited_addr,
-                   int router, int solicited, int override, int inc_opt) 
+                   int router, int solicited, int override, int inc_opt)
 {
         struct in6_addr tmpaddr;
         struct inet6_ifaddr *ifp;
         struct inet6_dev *idev;
         struct flowi fl;
         struct dst_entry* dst;
-        struct sock *sk = ndisc_socket->sk;
+        struct sock *sk = ndisc_socket->sk;
         struct in6_addr *src_addr;
-        struct nd_msg *msg;
-        int len;
-        struct sk_buff *skb;
+        struct nd_msg *msg;
+        int len;
+        struct sk_buff *skb;
         int err;
 
         len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
 
         /* for anycast or proxy, solicited_addr != src_addr */
         ifp = ipv6_get_ifaddr(solicited_addr, dev, 1);
-        if (ifp) {
+        if (ifp) {
                 src_addr = solicited_addr;
                 in6_ifa_put(ifp);
         } else {
@@ -479,7 +479,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 
         if (skb == NULL) {
                 ND_PRINTK0(KERN_ERR
-                           "ICMPv6 NA: %s() failed to allocate an skb.\n", 
+                           "ICMPv6 NA: %s() failed to allocate an skb.\n",
                            __FUNCTION__);
                 dst_release(dst);
                 return;
@@ -491,16 +491,16 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
         msg = (struct nd_msg *)skb_put(skb, len);
         skb->h.raw = (unsigned char*)msg;
 
-        msg->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
-        msg->icmph.icmp6_code = 0;
-        msg->icmph.icmp6_cksum = 0;
+        msg->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
+        msg->icmph.icmp6_code = 0;
+        msg->icmph.icmp6_cksum = 0;
 
-        msg->icmph.icmp6_unused = 0;
-        msg->icmph.icmp6_router    = router;
-        msg->icmph.icmp6_solicited = solicited;
-        msg->icmph.icmp6_override  = override;
+        msg->icmph.icmp6_unused = 0;
+        msg->icmph.icmp6_router    = router;
+        msg->icmph.icmp6_solicited = solicited;
+        msg->icmph.icmp6_override  = override;
 
-        /* Set the target address. */
+        /* Set the target address. */
         ipv6_addr_copy(&msg->target, solicited_addr);
 
         if (inc_opt)
@@ -508,9 +508,9 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                                        dev->addr_len, dev->type);
 
         /* checksum */
-        msg->icmph.icmp6_cksum = csum_ipv6_magic(src_addr, daddr, len, 
+        msg->icmph.icmp6_cksum = csum_ipv6_magic(src_addr, daddr, len,
                                                  IPPROTO_ICMPV6,
-                                                 csum_partial((__u8 *) msg, 
+                                                 csum_partial((__u8 *) msg,
                                                               len, 0));
 
         skb->dst = dst;
@@ -524,20 +524,20 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 
         if (likely(idev != NULL))
                 in6_dev_put(idev);
-}        
+}
 
 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
                    struct in6_addr *solicit,
-                   struct in6_addr *daddr, struct in6_addr *saddr) 
+                   struct in6_addr *daddr, struct in6_addr *saddr)
 {
         struct flowi fl;
         struct dst_entry* dst;
         struct inet6_dev *idev;
-        struct sock *sk = ndisc_socket->sk;
-        struct sk_buff *skb;
-        struct nd_msg *msg;
+        struct sock *sk = ndisc_socket->sk;
+        struct sk_buff *skb;
+        struct nd_msg *msg;
         struct in6_addr addr_buf;
-        int len;
+        int len;
         int err;
         int send_llinfo;
 
@@ -569,7 +569,7 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
                                   1, &err);
         if (skb == NULL) {
                 ND_PRINTK0(KERN_ERR
-                           "ICMPv6 NA: %s() failed to allocate an skb.\n", 
+                           "ICMPv6 NA: %s() failed to allocate an skb.\n",
                            __FUNCTION__);
                 dst_release(dst);
                 return;
@@ -594,9 +594,9 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 
         /* checksum */
         msg->icmph.icmp6_cksum = csum_ipv6_magic(&skb->nh.ipv6h->saddr,
-                                                 daddr, len, 
+                                                 daddr, len,
                                                  IPPROTO_ICMPV6,
-                                                 csum_partial((__u8 *) msg, 
+                                                 csum_partial((__u8 *) msg,
                                                               len, 0));
         /* send it! */
         skb->dst = dst;
@@ -619,10 +619,10 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
         struct dst_entry* dst;
         struct inet6_dev *idev;
         struct sock *sk = ndisc_socket->sk;
-        struct sk_buff *skb;
-        struct icmp6hdr *hdr;
+        struct sk_buff *skb;
+        struct icmp6hdr *hdr;
         __u8 * opt;
-        int len;
+        int len;
         int err;
 
         ndisc_flow_init(&fl, NDISC_ROUTER_SOLICITATION, saddr, daddr,
@@ -640,13 +640,13 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
         if (dev->addr_len)
                 len += ndisc_opt_addr_space(dev);
 
-        skb = sock_alloc_send_skb(sk,
+        skb = sock_alloc_send_skb(sk,
                                   (MAX_HEADER + sizeof(struct ipv6hdr) +
                                    len + LL_RESERVED_SPACE(dev)),
                                   1, &err);
         if (skb == NULL) {
                 ND_PRINTK0(KERN_ERR
-                           "ICMPv6 RS: %s() failed to allocate an skb.\n", 
+                           "ICMPv6 RS: %s() failed to allocate an skb.\n",
                            __FUNCTION__);
                 dst_release(dst);
                 return;
@@ -655,12 +655,12 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
         ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
 
-        hdr = (struct icmp6hdr *)skb_put(skb, len);
-        skb->h.raw = (unsigned char*)hdr;
-        hdr->icmp6_type = NDISC_ROUTER_SOLICITATION;
-        hdr->icmp6_code = 0;
-        hdr->icmp6_cksum = 0;
-        hdr->icmp6_unused = 0;
+        hdr = (struct icmp6hdr *)skb_put(skb, len);
+        skb->h.raw = (unsigned char*)hdr;
+        hdr->icmp6_type = NDISC_ROUTER_SOLICITATION;
+        hdr->icmp6_code = 0;
+        hdr->icmp6_cksum = 0;
+        hdr->icmp6_unused = 0;
 
         opt = (u8*) (hdr + 1);
 
@@ -686,7 +686,7 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
         if (likely(idev != NULL))
                 in6_dev_put(idev);
 }
-                   
+
 
 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 {
@@ -748,7 +748,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         int is_router;
 
         if (ipv6_addr_is_multicast(&msg->target)) {
-                ND_PRINTK2(KERN_WARNING 
+                ND_PRINTK2(KERN_WARNING
                            "ICMPv6 NS: multicast target address");
                 return;
         }
@@ -768,7 +768,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         }
 
         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
-                ND_PRINTK2(KERN_WARNING 
+                ND_PRINTK2(KERN_WARNING
                            "ICMPv6 NS: invalid ND options\n");
                 return;
         }
@@ -782,12 +782,12 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                 }
 
                 /* RFC2461 7.1.1:
-                 *      If the IP source address is the unspecified address, 
-                 *      there MUST NOT be source link-layer address option 
+                 *      If the IP source address is the unspecified address,
+                 *      there MUST NOT be source link-layer address option
                  *      in the message.
                  */
                 if (dad) {
-                        ND_PRINTK2(KERN_WARNING 
+                        ND_PRINTK2(KERN_WARNING
                                    "ICMPv6 NS: bad DAD packet (link-layer address option)\n");
                         return;
                 }
@@ -816,7 +816,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                                         goto out;
                                 }
                         }
-                        addrconf_dad_failure(ifp); 
+                        addrconf_dad_failure(ifp);
                         return;
                 }
 
@@ -829,7 +829,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                 }
 
                 if (ipv6_chk_acast_addr(dev, &msg->target) ||
-                    (idev->cnf.forwarding && 
+                    (idev->cnf.forwarding &&
                      (ipv6_devconf.proxy_ndp || idev->cnf.proxy_ndp) &&
                      (pneigh = pneigh_lookup(&nd_tbl,
                                              &msg->target, dev, 0)) != NULL)) {
@@ -839,8 +839,8 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                             idev->nd_parms->proxy_delay != 0) {
                                 /*
                                  * for anycast or proxy,
-                                 * sender should delay its response 
-                                 * by a random time between 0 and 
+                                 * sender should delay its response
+                                 * by a random time between 0 and
                                  * MAX_ANYCAST_DELAY_TIME seconds.
                                  * (RFC2461) -- yoshfuji
                                  */
@@ -869,14 +869,14 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         else
                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 
-        /* 
+        /*
          *      update / create cache entry
          *      for the source address
          */
         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
                                !inc || lladdr || !dev->addr_len);
         if (neigh)
-                neigh_update(neigh, lladdr, NUD_STALE, 
+                neigh_update(neigh, lladdr, NUD_STALE,
                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
                              NEIGH_UPDATE_F_OVERRIDE);
         if (neigh || !dev->hard_header) {
@@ -926,7 +926,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
                            "ICMPv6 NA: solicited NA is multicasted.\n");
                 return;
         }
-                
+
         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
                 ND_PRINTK2(KERN_WARNING
                            "ICMPv6 NS: invalid ND option\n");
@@ -1057,7 +1057,7 @@ out:
 
 static void ndisc_router_discovery(struct sk_buff *skb)
 {
-        struct ra_msg *ra_msg = (struct ra_msg *) skb->h.raw;
+        struct ra_msg *ra_msg = (struct ra_msg *) skb->h.raw;
         struct neighbour *neigh = NULL;
         struct inet6_dev *in6_dev;
         struct rt6_info *rt = NULL;
@@ -1076,7 +1076,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                 return;
         }
         if (optlen < 0) {
-                ND_PRINTK2(KERN_WARNING 
+                ND_PRINTK2(KERN_WARNING
                            "ICMPv6 RA: packet too short\n");
                 return;
         }
@@ -1286,7 +1286,7 @@ skip_defrtr:
                         rt6_mtu_change(skb->dev, mtu);
                 }
         }
-                        
+
         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
                 ND_PRINTK2(KERN_WARNING
                            "ICMPv6 RA: invalid RA options");
@@ -1339,7 +1339,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         if (ipv6_addr_equal(dest, target)) {
                 on_link = 1;
         } else if (!(ipv6_addr_type(target) & IPV6_ADDR_LINKLOCAL)) {
-                ND_PRINTK2(KERN_WARNING 
+                ND_PRINTK2(KERN_WARNING
                            "ICMPv6 Redirect: target address is not link-local.\n");
                 return;
         }
@@ -1352,11 +1352,11 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
                 return;
         }
 
-        /* RFC2461 8.1: 
+        /* RFC2461 8.1:
          *      The IP source address of the Redirect MUST be the same as the current
          *      first-hop router for the specified ICMP Destination Address.
          */
-                
+
         if (!ndisc_parse_options((u8*)(dest + 1), optlen, &ndopts)) {
                 ND_PRINTK2(KERN_WARNING
                            "ICMPv6 Redirect: invalid ND options\n");
@@ -1410,8 +1410,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                 ND_PRINTK2(KERN_WARNING
                            "ICMPv6 Redirect: no link-local address on %s\n",
                            dev->name);
-                return;
-        }
+                return;
+        }
 
         if (!ipv6_addr_equal(&skb->nh.ipv6h->daddr, target) &&
             !(ipv6_addr_type(target) & IPV6_ADDR_LINKLOCAL)) {
@@ -1507,7 +1507,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
          *      build redirect option and copy skb over to the new packet.
          */
 
-        memset(opt, 0, 8);      
+        memset(opt, 0, 8);
         *(opt++) = ND_OPT_REDIRECT_HDR;
         *(opt++) = (rd_len >> 3);
         opt += 6;
@@ -1556,7 +1556,7 @@ int ndisc_rcv(struct sk_buff *skb)
         }
 
         if (msg->icmph.icmp6_code != 0) {
-                ND_PRINTK2(KERN_WARNING 
+                ND_PRINTK2(KERN_WARNING
                            "ICMPv6 NDISC: invalid ICMPv6 code: %d\n",
                            msg->icmph.icmp6_code);
                 return 0;
@@ -1717,12 +1717,12 @@ int __init ndisc_init(struct net_proto_family *ops)
 {
         struct ipv6_pinfo *np;
         struct sock *sk;
-        int err;
+        int err;
 
         err = sock_create_kern(PF_INET6, SOCK_RAW, IPPROTO_ICMPV6, &ndisc_socket);
         if (err < 0) {
                 ND_PRINTK0(KERN_ERR
-                           "ICMPv6 NDISC: Failed to initialize the control socket (err %d).\n", 
+                           "ICMPv6 NDISC: Failed to initialize the control socket (err %d).\n",
                            err);
                 ndisc_socket = NULL; /* For safety. */
                 return err;
@@ -1736,14 +1736,14 @@ int __init ndisc_init(struct net_proto_family *ops)
         np->mc_loop = 0;
         sk->sk_prot->unhash(sk);
 
-        /*
-         * Initialize the neighbour table
-         */
-        
+        /*
+         * Initialize the neighbour table
+         */
+
         neigh_table_init(&nd_tbl);
 
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_register(NULL, &nd_tbl.parms, NET_IPV6, NET_IPV6_NEIGH, 
+        neigh_sysctl_register(NULL, &nd_tbl.parms, NET_IPV6, NET_IPV6_NEIGH,
                               "ipv6",
                               &ndisc_ifinfo_sysctl_change,
                               &ndisc_ifinfo_sysctl_strategy);
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index f6294e5bcb31..0b2d265e7da7 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -91,7 +91,7 @@ __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
                 if (hook != NF_IP6_PRE_ROUTING && hook != NF_IP6_LOCAL_IN)
                         break;
                 if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
-                                     skb->len - dataoff, protocol,
+                                     skb->len - dataoff, protocol,
                                      csum_sub(skb->csum,
                                               skb_checksum(skb, 0,
                                                            dataoff, 0)))) {
@@ -106,7 +106,7 @@ __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
                                              protocol,
                                              csum_sub(0,
                                                       skb_checksum(skb, 0,
-                                                                   dataoff, 0))));
+                                                                   dataoff, 0))));
                 csum = __skb_checksum_complete(skb);
         }
         return csum;
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index adcd6131df2a..da07e9a88ee9 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -42,7 +42,8 @@ config IP6_NF_QUEUE
 
 config IP6_NF_IPTABLES
         tristate "IP6 tables support (required for filtering)"
-        depends on INET && IPV6 && EXPERIMENTAL && NETFILTER_XTABLES
+        depends on INET && IPV6 && EXPERIMENTAL
+        select NETFILTER_XTABLES
         help
           ip6tables is a general, extensible packet identification framework.
           Currently only the packet filtering and packet mangling subsystem
@@ -114,6 +115,14 @@ config IP6_NF_MATCH_AH
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP6_NF_MATCH_MH
+        tristate "MH match support"
+        depends on IP6_NF_IPTABLES
+        help
+          This module allows one to match MH packets.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config IP6_NF_MATCH_EUI64
         tristate "EUI64 address check"
         depends on IP6_NF_IPTABLES
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index ac1dfebde175..4513eab77397 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -19,6 +19,7 @@ obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
 obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
+obj-$(CONFIG_IP6_NF_MATCH_MH) += ip6t_mh.o
 
 # objects for l3 independent conntrack
 nf_conntrack_ipv6-objs  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o nf_conntrack_reasm.o
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index d4d9f182441a..58847d3b61e5 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -95,7 +95,7 @@ __ipq_find_entry(ipq_cmpfn cmpfn, unsigned long data)
 
         list_for_each_prev(p, &queue_list) {
                 struct ipq_queue_entry *entry = (struct ipq_queue_entry *)p;
-                
+
                 if (!cmpfn || cmpfn(entry, data))
                         return entry;
         }
@@ -127,7 +127,7 @@ static inline void
 __ipq_flush(int verdict)
 {
         struct ipq_queue_entry *entry;
-        
+
         while ((entry = __ipq_find_dequeue_entry(NULL, 0)))
                 ipq_issue_verdict(entry, verdict);
 }
@@ -136,21 +136,21 @@ static inline int
 __ipq_set_mode(unsigned char mode, unsigned int range)
 {
         int status = 0;
-        
+
         switch(mode) {
         case IPQ_COPY_NONE:
         case IPQ_COPY_META:
                 copy_mode = mode;
                 copy_range = 0;
                 break;
-                
+
         case IPQ_COPY_PACKET:
                 copy_mode = mode;
                 copy_range = range;
                 if (copy_range > 0xFFFF)
                         copy_range = 0xFFFF;
                 break;
-                
+
         default:
                 status = -EINVAL;
 
@@ -171,7 +171,7 @@ static struct ipq_queue_entry *
 ipq_find_dequeue_entry(ipq_cmpfn cmpfn, unsigned long data)
 {
         struct ipq_queue_entry *entry;
-        
+
         write_lock_bh(&queue_lock);
         entry = __ipq_find_dequeue_entry(cmpfn, data);
         write_unlock_bh(&queue_lock);
@@ -197,14 +197,14 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
         struct nlmsghdr *nlh;
 
         read_lock_bh(&queue_lock);
-        
+
         switch (copy_mode) {
         case IPQ_COPY_META:
         case IPQ_COPY_NONE:
                 size = NLMSG_SPACE(sizeof(*pmsg));
                 data_len = 0;
                 break;
-        
+
         case IPQ_COPY_PACKET:
                 if ((entry->skb->ip_summed == CHECKSUM_PARTIAL ||
                      entry->skb->ip_summed == CHECKSUM_COMPLETE) &&
@@ -216,10 +216,10 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                         data_len = entry->skb->len;
                 else
                         data_len = copy_range;
-                
+
                 size = NLMSG_SPACE(sizeof(*pmsg) + data_len);
                 break;
-        
+
         default:
                 *errp = -EINVAL;
                 read_unlock_bh(&queue_lock);
@@ -231,7 +231,7 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
         skb = alloc_skb(size, GFP_ATOMIC);
         if (!skb)
                 goto nlmsg_failure;
-                
+
         old_tail= skb->tail;
         nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
         pmsg = NLMSG_DATA(nlh);
@@ -244,29 +244,29 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
         pmsg->mark            = entry->skb->mark;
         pmsg->hook            = entry->info->hook;
         pmsg->hw_protocol     = entry->skb->protocol;
-        
+
         if (entry->info->indev)
                 strcpy(pmsg->indev_name, entry->info->indev->name);
         else
                 pmsg->indev_name[0] = '\0';
-        
+
         if (entry->info->outdev)
                 strcpy(pmsg->outdev_name, entry->info->outdev->name);
         else
                 pmsg->outdev_name[0] = '\0';
-        
+
         if (entry->info->indev && entry->skb->dev) {
                 pmsg->hw_type = entry->skb->dev->type;
                 if (entry->skb->dev->hard_header_parse)
                         pmsg->hw_addrlen =
                                 entry->skb->dev->hard_header_parse(entry->skb,
-                                                                   pmsg->hw_addr);
+                                                                   pmsg->hw_addr);
         }
-        
+
         if (data_len)
                 if (skb_copy_bits(entry->skb, 0, pmsg->payload, data_len))
                         BUG();
-                
+
         nlh->nlmsg_len = skb->tail - old_tail;
         return skb;
 
@@ -279,7 +279,7 @@ nlmsg_failure:
 }
 
 static int
-ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, 
+ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
                    unsigned int queuenum, void *data)
 {
         int status = -EINVAL;
@@ -301,37 +301,37 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
         nskb = ipq_build_packet_message(entry, &status);
         if (nskb == NULL)
                 goto err_out_free;
-                
+
         write_lock_bh(&queue_lock);
-        
+
         if (!peer_pid)
-                goto err_out_free_nskb; 
+                goto err_out_free_nskb;
 
         if (queue_total >= queue_maxlen) {
-                queue_dropped++;
+                queue_dropped++;
                 status = -ENOSPC;
                 if (net_ratelimit())
-                        printk (KERN_WARNING "ip6_queue: fill at %d entries, "
+                        printk (KERN_WARNING "ip6_queue: fill at %d entries, "
                                 "dropping packet(s).  Dropped: %d\n", queue_total,
                                 queue_dropped);
                 goto err_out_free_nskb;
         }
 
-        /* netlink_unicast will either free the nskb or attach it to a socket */ 
+        /* netlink_unicast will either free the nskb or attach it to a socket */
         status = netlink_unicast(ipqnl, nskb, peer_pid, MSG_DONTWAIT);
         if (status < 0) {
-                queue_user_dropped++;
+                queue_user_dropped++;
                 goto err_out_unlock;
         }
-        
+
         __ipq_enqueue_entry(entry);
 
         write_unlock_bh(&queue_lock);
         return status;
-        
+
 err_out_free_nskb:
-        kfree_skb(nskb); 
-        
+        kfree_skb(nskb);
+
 err_out_unlock:
         write_unlock_bh(&queue_lock);
 
@@ -357,11 +357,11 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
                         return -EINVAL;
                 if (diff > skb_tailroom(e->skb)) {
                         struct sk_buff *newskb;
-                        
+
                         newskb = skb_copy_expand(e->skb,
-                                                 skb_headroom(e->skb),
-                                                 diff,
-                                                 GFP_ATOMIC);
+                                                 skb_headroom(e->skb),
+                                                 diff,
+                                                 GFP_ATOMIC);
                         if (newskb == NULL) {
                                 printk(KERN_WARNING "ip6_queue: OOM "
                                       "in mangle, dropping packet\n");
@@ -401,11 +401,11 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
                 return -ENOENT;
         else {
                 int verdict = vmsg->value;
-                
+
                 if (vmsg->data_len && vmsg->data_len == len)
                         if (ipq_mangle_ipv6(vmsg, entry) < 0)
                                 verdict = NF_DROP;
-                
+
                 ipq_issue_verdict(entry, verdict);
                 return 0;
         }
@@ -424,7 +424,7 @@ ipq_set_mode(unsigned char mode, unsigned int range)
 
 static int
 ipq_receive_peer(struct ipq_peer_msg *pmsg,
-                 unsigned char type, unsigned int len)
+                 unsigned char type, unsigned int len)
 {
         int status = 0;
 
@@ -434,15 +434,15 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
         switch (type) {
         case IPQM_MODE:
                 status = ipq_set_mode(pmsg->msg.mode.value,
-                                      pmsg->msg.mode.range);
+                                      pmsg->msg.mode.range);
                 break;
-                
+
         case IPQM_VERDICT:
                 if (pmsg->msg.verdict.value > NF_MAX_VERDICT)
                         status = -EINVAL;
                 else
                         status = ipq_set_verdict(&pmsg->msg.verdict,
-                                                 len - sizeof(*pmsg));
+                                                 len - sizeof(*pmsg));
                         break;
         default:
                 status = -EINVAL;
@@ -456,7 +456,7 @@ dev_cmp(struct ipq_queue_entry *entry, unsigned long ifindex)
         if (entry->info->indev)
                 if (entry->info->indev->ifindex == ifindex)
                         return 1;
-                        
+
         if (entry->info->outdev)
                 if (entry->info->outdev->ifindex == ifindex)
                         return 1;
@@ -468,7 +468,7 @@ static void
 ipq_dev_drop(int ifindex)
 {
         struct ipq_queue_entry *entry;
-        
+
         while ((entry = ipq_find_dequeue_entry(dev_cmp, ifindex)) != NULL)
                 ipq_issue_verdict(entry, NF_DROP);
 }
@@ -492,25 +492,25 @@ ipq_rcv_skb(struct sk_buff *skb)
 
         pid = nlh->nlmsg_pid;
         flags = nlh->nlmsg_flags;
-        
+
         if(pid <= 0 || !(flags & NLM_F_REQUEST) || flags & NLM_F_MULTI)
                 RCV_SKB_FAIL(-EINVAL);
-                
+
         if (flags & MSG_TRUNC)
                 RCV_SKB_FAIL(-ECOMM);
-                
+
         type = nlh->nlmsg_type;
         if (type < NLMSG_NOOP || type >= IPQM_MAX)
                 RCV_SKB_FAIL(-EINVAL);
-                
+
         if (type <= IPQM_BASE)
                 return;
-        
+
         if (security_netlink_recv(skb, CAP_NET_ADMIN))
-                RCV_SKB_FAIL(-EPERM);   
+                RCV_SKB_FAIL(-EPERM);
 
         write_lock_bh(&queue_lock);
-        
+
         if (peer_pid) {
                 if (peer_pid != pid) {
                         write_unlock_bh(&queue_lock);
@@ -520,17 +520,17 @@ ipq_rcv_skb(struct sk_buff *skb)
                 net_enable_timestamp();
                 peer_pid = pid;
         }
-                
+
         write_unlock_bh(&queue_lock);
-        
+
         status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                  nlmsglen - NLMSG_LENGTH(0));
+                                  nlmsglen - NLMSG_LENGTH(0));
         if (status < 0)
                 RCV_SKB_FAIL(status);
-                
+
         if (flags & NLM_F_ACK)
                 netlink_ack(skb, nlh, 0);
-        return;
+        return;
 }
 
 static void
@@ -540,19 +540,19 @@ ipq_rcv_sk(struct sock *sk, int len)
         unsigned int qlen;
 
         mutex_lock(&ipqnl_mutex);
-                        
+
         for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) {
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 ipq_rcv_skb(skb);
                 kfree_skb(skb);
         }
-                
+
         mutex_unlock(&ipqnl_mutex);
 }
 
 static int
 ipq_rcv_dev_event(struct notifier_block *this,
-                  unsigned long event, void *ptr)
+                  unsigned long event, void *ptr)
 {
         struct net_device *dev = ptr;
 
@@ -568,7 +568,7 @@ static struct notifier_block ipq_dev_notifier = {
 
 static int
 ipq_rcv_nl_event(struct notifier_block *this,
-                 unsigned long event, void *ptr)
+                 unsigned long event, void *ptr)
 {
         struct netlink_notify *n = ptr;
 
@@ -597,7 +597,7 @@ static ctl_table ipq_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { .ctl_name = 0 }
+        { .ctl_name = 0 }
 };
 
 static ctl_table ipq_dir_table[] = {
@@ -627,25 +627,25 @@ ipq_get_info(char *buffer, char **start, off_t offset, int length)
         int len;
 
         read_lock_bh(&queue_lock);
-        
+
         len = sprintf(buffer,
-                      "Peer PID          : %d\n"
-                      "Copy mode         : %hu\n"
-                      "Copy range        : %u\n"
-                      "Queue length      : %u\n"
-                      "Queue max. length : %u\n"
+                      "Peer PID          : %d\n"
+                      "Copy mode         : %hu\n"
+                      "Copy range        : %u\n"
+                      "Queue length      : %u\n"
+                      "Queue max. length : %u\n"
                       "Queue dropped     : %u\n"
                       "Netfilter dropped : %u\n",
-                      peer_pid,
-                      copy_mode,
-                      copy_range,
-                      queue_total,
-                      queue_maxlen,
+                      peer_pid,
+                      copy_mode,
+                      copy_range,
+                      queue_total,
+                      queue_maxlen,
                       queue_dropped,
                       queue_user_dropped);
 
         read_unlock_bh(&queue_lock);
-        
+
         *start = buffer + offset;
         len -= offset;
         if (len > length)
@@ -665,10 +665,10 @@ static int __init ip6_queue_init(void)
 {
         int status = -ENOMEM;
         struct proc_dir_entry *proc;
-        
+
         netlink_register_notifier(&ipq_nl_notifier);
         ipqnl = netlink_kernel_create(NETLINK_IP6_FW, 0, ipq_rcv_sk,
-                                      THIS_MODULE);
+                                      THIS_MODULE);
         if (ipqnl == NULL) {
                 printk(KERN_ERR "ip6_queue: failed to create netlink socket\n");
                 goto cleanup_netlink_notifier;
@@ -681,10 +681,10 @@ static int __init ip6_queue_init(void)
                 printk(KERN_ERR "ip6_queue: failed to create proc entry\n");
                 goto cleanup_ipqnl;
         }
-        
+
         register_netdevice_notifier(&ipq_dev_notifier);
         ipq_sysctl_header = register_sysctl_table(ipq_root_table, 0);
-        
+
         status = nf_register_queue_handler(PF_INET6, &nfqh);
         if (status < 0) {
                 printk(KERN_ERR "ip6_queue: failed to register queue handler\n");
@@ -696,12 +696,12 @@ cleanup_sysctl:
         unregister_sysctl_table(ipq_sysctl_header);
         unregister_netdevice_notifier(&ipq_dev_notifier);
         proc_net_remove(IPQ_PROC_FS_NAME);
-        
+
 cleanup_ipqnl:
         sock_release(ipqnl->sk_socket);
         mutex_lock(&ipqnl_mutex);
         mutex_unlock(&ipqnl_mutex);
-        
+
 cleanup_netlink_notifier:
         netlink_unregister_notifier(&ipq_nl_notifier);
         return status;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 99502c5da4c4..7c512e13f956 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -92,16 +92,16 @@ do {								\
 #endif
 
 /* Check for an extension */
-int 
+int
 ip6t_ext_hdr(u8 nexthdr)
 {
-        return ( (nexthdr == IPPROTO_HOPOPTS)   ||
-                 (nexthdr == IPPROTO_ROUTING)   ||
-                 (nexthdr == IPPROTO_FRAGMENT)  ||
-                 (nexthdr == IPPROTO_ESP)       ||
-                 (nexthdr == IPPROTO_AH)        ||
-                 (nexthdr == IPPROTO_NONE)      ||
-                 (nexthdr == IPPROTO_DSTOPTS) );
+        return ( (nexthdr == IPPROTO_HOPOPTS)   ||
+                 (nexthdr == IPPROTO_ROUTING)   ||
+                 (nexthdr == IPPROTO_FRAGMENT)  ||
+                 (nexthdr == IPPROTO_ESP)       ||
+                 (nexthdr == IPPROTO_AH)        ||
+                 (nexthdr == IPPROTO_NONE)      ||
+                 (nexthdr == IPPROTO_DSTOPTS) );
 }
 
 /* Returns whether matches rule or not. */
@@ -120,9 +120,9 @@ ip6_packet_match(const struct sk_buff *skb,
 #define FWINV(bool,invflg) ((bool) ^ !!(ip6info->invflags & invflg))
 
         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
-                                       &ip6info->src), IP6T_INV_SRCIP)
+                                       &ip6info->src), IP6T_INV_SRCIP)
             || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
-                                          &ip6info->dst), IP6T_INV_DSTIP)) {
+                                          &ip6info->dst), IP6T_INV_DSTIP)) {
                 dprintf("Source or dest mismatch.\n");
 /*
                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
@@ -177,7 +177,7 @@ ip6_packet_match(const struct sk_buff *skb,
                 *fragoff = _frag_off;
 
                 dprintf("Packet protocol %hi ?= %s%hi.\n",
-                                protohdr, 
+                                protohdr,
                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
                                 ip6info->proto);
 
@@ -197,7 +197,7 @@ ip6_packet_match(const struct sk_buff *skb,
 }
 
 /* should be ip6 safe */
-static inline int 
+static inline int
 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 {
         if (ipv6->flags & ~IP6T_F_MASK) {
@@ -337,7 +337,7 @@ ip6t_do_table(struct sk_buff **pskb,
                                 e = get_entry(table_base, v);
                         } else {
                                 /* Targets which reenter must return
-                                   abs. verdicts */
+                                   abs. verdicts */
 #ifdef CONFIG_NETFILTER_DEBUG
                                 ((struct ip6t_entry *)table_base)->comefrom
                                         = 0xeeeeeeec;
@@ -530,14 +530,14 @@ check_match(struct ip6t_entry_match *m,
             unsigned int hookmask,
             unsigned int *i)
 {
-        struct ip6t_match *match;
+        struct xt_match *match;
         int ret;
 
         match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
-                                        m->u.user.revision),
+                                        m->u.user.revision),
                                         "ip6t_%s", m->u.user.name);
         if (IS_ERR(match) || !match) {
-                duprintf("check_match: `%s' not found\n", m->u.user.name);
+                duprintf("check_match: `%s' not found\n", m->u.user.name);
                 return match ? PTR_ERR(match) : -ENOENT;
         }
         m->u.kernel.match = match;
@@ -564,14 +564,14 @@ err:
         return ret;
 }
 
-static struct ip6t_target ip6t_standard_target;
+static struct xt_target ip6t_standard_target;
 
 static inline int
 check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
             unsigned int *i)
 {
         struct ip6t_entry_target *t;
-        struct ip6t_target *target;
+        struct xt_target *target;
         int ret;
         unsigned int j;
 
@@ -661,7 +661,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
         }
 
         /* FIXME: underflows must be unconditional, standard verdicts
-           < 0 (not IP6T_RETURN). --RR */
+           < 0 (not IP6T_RETURN). --RR */
 
         /* Clear counters and comefrom */
         e->counters = ((struct xt_counters) { 0, 0 });
@@ -1003,8 +1003,8 @@ do_replace(void __user *user, unsigned int len)
         /* Update module usage count based on number of rules */
         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
-        if ((oldinfo->number > oldinfo->initial_entries) || 
-            (newinfo->number <= oldinfo->initial_entries)) 
+        if ((oldinfo->number > oldinfo->initial_entries) ||
+            (newinfo->number <= oldinfo->initial_entries))
                 module_put(t->me);
         if ((oldinfo->number > oldinfo->initial_entries) &&
             (newinfo->number <= oldinfo->initial_entries))
@@ -1348,13 +1348,13 @@ icmp6_checkentry(const char *tablename,
 }
 
 /* The built-in targets: standard (NULL) and error. */
-static struct ip6t_target ip6t_standard_target = {
+static struct xt_target ip6t_standard_target = {
         .name           = IP6T_STANDARD_TARGET,
         .targetsize     = sizeof(int),
         .family         = AF_INET6,
 };
 
-static struct ip6t_target ip6t_error_target = {
+static struct xt_target ip6t_error_target = {
         .name           = IP6T_ERROR_TARGET,
         .target         = ip6t_error,
         .targetsize     = IP6T_FUNCTION_MAXNAMELEN,
@@ -1371,7 +1371,7 @@ static struct nf_sockopt_ops ip6t_sockopts = {
         .get            = do_ip6t_get_ctl,
 };
 
-static struct ip6t_match icmp6_matchstruct = {
+static struct xt_match icmp6_matchstruct = {
         .name           = "icmp6",
         .match          = &icmp6_match,
         .matchsize      = sizeof(struct ip6t_icmp),
@@ -1492,9 +1492,9 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                         }
                         hdrlen = 8;
                 } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen + 2) << 2; 
+                        hdrlen = (hp->hdrlen + 2) << 2;
                 else
-                        hdrlen = ipv6_optlen(hp); 
+                        hdrlen = ipv6_optlen(hp);
 
                 nexthdr = hp->nexthdr;
                 len -= hdrlen;
diff --git a/net/ipv6/netfilter/ip6t_HL.c b/net/ipv6/netfilter/ip6t_HL.c
index 435750f664dd..ccbab66277e3 100644
--- a/net/ipv6/netfilter/ip6t_HL.c
+++ b/net/ipv6/netfilter/ip6t_HL.c
@@ -1,4 +1,4 @@
-/* 
+/*
  * Hop Limit modification target for ip6tables
  * Maciej Soltysiak <solt@dns.toxicfilms.tv>
  * Based on HW's TTL module
@@ -9,15 +9,16 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
+#include <linux/ipv6.h>
 
-#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6t_HL.h>
 
 MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
-MODULE_DESCRIPTION("IP tables Hop Limit modification module");
+MODULE_DESCRIPTION("IP6 tables Hop Limit modification module");
 MODULE_LICENSE("GPL");
 
-static unsigned int ip6t_hl_target(struct sk_buff **pskb, 
+static unsigned int ip6t_hl_target(struct sk_buff **pskb,
                                    const struct net_device *in,
                                    const struct net_device *out,
                                    unsigned int hooknum,
@@ -52,10 +53,9 @@ static unsigned int ip6t_hl_target(struct sk_buff **pskb,
                         break;
         }
 
-        if (new_hl != ip6h->hop_limit)
-                ip6h->hop_limit = new_hl;
+        ip6h->hop_limit = new_hl;
 
-        return IP6T_CONTINUE;
+        return XT_CONTINUE;
 }
 
 static int ip6t_hl_checkentry(const char *tablename,
@@ -67,7 +67,7 @@ static int ip6t_hl_checkentry(const char *tablename,
         struct ip6t_HL_info *info = targinfo;
 
         if (info->mode > IP6T_HL_MAXMODE) {
-                printk(KERN_WARNING "ip6t_HL: invalid or unknown Mode %u\n", 
+                printk(KERN_WARNING "ip6t_HL: invalid or unknown Mode %u\n",
                         info->mode);
                 return 0;
         }
@@ -79,23 +79,24 @@ static int ip6t_hl_checkentry(const char *tablename,
         return 1;
 }
 
-static struct ip6t_target ip6t_HL = { 
-        .name           = "HL", 
-        .target         = ip6t_hl_target, 
+static struct xt_target ip6t_HL = {
+        .name           = "HL",
+        .family         = AF_INET6,
+        .target         = ip6t_hl_target,
         .targetsize     = sizeof(struct ip6t_HL_info),
         .table          = "mangle",
-        .checkentry     = ip6t_hl_checkentry, 
+        .checkentry     = ip6t_hl_checkentry,
         .me             = THIS_MODULE
 };
 
 static int __init ip6t_hl_init(void)
 {
-        return ip6t_register_target(&ip6t_HL);
+        return xt_register_target(&ip6t_HL);
 }
 
 static void __exit ip6t_hl_fini(void)
 {
-        ip6t_unregister_target(&ip6t_HL);
+        xt_unregister_target(&ip6t_HL);
 }
 
 module_init(ip6t_hl_init);
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 33b1faa90d74..afaa039d0b7b 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -21,6 +21,7 @@
 #include <net/tcp.h>
 #include <net/ipv6.h>
 #include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 
 MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
@@ -144,7 +145,7 @@ static void dump_packet(const struct nf_loginfo *info,
                                                         &_ahdr);
                                 if (ah == NULL) {
                                         /*
-                                         * Max length: 26 "INCOMPLETE [65535    
+                                         * Max length: 26 "INCOMPLETE [65535
                                          *  bytes] )"
                                          */
                                         printk("INCOMPLETE [%u bytes] )",
@@ -386,7 +387,7 @@ ip6t_log_packet(unsigned int pf,
                 loginfo = &default_loginfo;
 
         spin_lock_bh(&log_lock);
-        printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level, 
+        printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
                 prefix,
                 in ? in->name : "",
                 out ? out->name : "");
@@ -441,8 +442,8 @@ ip6t_log_target(struct sk_buff **pskb,
         li.u.log.logflags = loginfo->logflags;
 
         ip6t_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
-                        loginfo->prefix);
-        return IP6T_CONTINUE;
+                        loginfo->prefix);
+        return XT_CONTINUE;
 }
 
 
@@ -466,11 +467,12 @@ static int ip6t_log_checkentry(const char *tablename,
         return 1;
 }
 
-static struct ip6t_target ip6t_log_reg = {
+static struct xt_target ip6t_log_reg = {
         .name           = "LOG",
-        .target         = ip6t_log_target, 
+        .family         = AF_INET6,
+        .target         = ip6t_log_target,
         .targetsize     = sizeof(struct ip6t_log_info),
-        .checkentry     = ip6t_log_checkentry, 
+        .checkentry     = ip6t_log_checkentry,
         .me             = THIS_MODULE,
 };
 
@@ -482,8 +484,11 @@ static struct nf_logger ip6t_logger = {
 
 static int __init ip6t_log_init(void)
 {
-        if (ip6t_register_target(&ip6t_log_reg))
-                return -EINVAL;
+        int ret;
+
+        ret = xt_register_target(&ip6t_log_reg);
+        if (ret < 0)
+                return ret;
         if (nf_log_register(PF_INET6, &ip6t_logger) < 0) {
                 printk(KERN_WARNING "ip6t_LOG: not logging via system console "
                        "since somebody else already registered for PF_INET6\n");
@@ -496,8 +501,8 @@ static int __init ip6t_log_init(void)
 
 static void __exit ip6t_log_fini(void)
 {
-        nf_log_unregister_logger(&ip6t_logger);
-        ip6t_unregister_target(&ip6t_log_reg);
+        nf_log_unregister(&ip6t_logger);
+        xt_unregister_target(&ip6t_log_reg);
 }
 
 module_init(ip6t_log_init);
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 311eae82feb3..6abee94c929f 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -26,6 +26,7 @@
 #include <net/ip6_fib.h>
 #include <net/ip6_route.h>
 #include <net/flow.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_ipv6/ip6t_REJECT.h>
 
@@ -188,23 +189,23 @@ static unsigned int reject6_target(struct sk_buff **pskb,
         /* WARNING: This code causes reentry within ip6tables.
            This means that the ip6tables jump stack is now crap.  We
            must return an absolute verdict. --RR */
-        switch (reject->with) {
-        case IP6T_ICMP6_NO_ROUTE:
-                send_unreach(*pskb, ICMPV6_NOROUTE, hooknum);
-                break;
-        case IP6T_ICMP6_ADM_PROHIBITED:
-                send_unreach(*pskb, ICMPV6_ADM_PROHIBITED, hooknum);
-                break;
-        case IP6T_ICMP6_NOT_NEIGHBOUR:
-                send_unreach(*pskb, ICMPV6_NOT_NEIGHBOUR, hooknum);
-                break;
-        case IP6T_ICMP6_ADDR_UNREACH:
-                send_unreach(*pskb, ICMPV6_ADDR_UNREACH, hooknum);
-                break;
-        case IP6T_ICMP6_PORT_UNREACH:
-                send_unreach(*pskb, ICMPV6_PORT_UNREACH, hooknum);
-                break;
-        case IP6T_ICMP6_ECHOREPLY:
+        switch (reject->with) {
+        case IP6T_ICMP6_NO_ROUTE:
+                send_unreach(*pskb, ICMPV6_NOROUTE, hooknum);
+                break;
+        case IP6T_ICMP6_ADM_PROHIBITED:
+                send_unreach(*pskb, ICMPV6_ADM_PROHIBITED, hooknum);
+                break;
+        case IP6T_ICMP6_NOT_NEIGHBOUR:
+                send_unreach(*pskb, ICMPV6_NOT_NEIGHBOUR, hooknum);
+                break;
+        case IP6T_ICMP6_ADDR_UNREACH:
+                send_unreach(*pskb, ICMPV6_ADDR_UNREACH, hooknum);
+                break;
+        case IP6T_ICMP6_PORT_UNREACH:
+                send_unreach(*pskb, ICMPV6_PORT_UNREACH, hooknum);
+                break;
+        case IP6T_ICMP6_ECHOREPLY:
                 /* Do nothing */
                 break;
         case IP6T_TCP_RESET:
@@ -225,7 +226,7 @@ static int check(const char *tablename,
                  void *targinfo,
                  unsigned int hook_mask)
 {
-        const struct ip6t_reject_info *rejinfo = targinfo;
+        const struct ip6t_reject_info *rejinfo = targinfo;
         const struct ip6t_entry *e = entry;
 
         if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
@@ -234,7 +235,7 @@ static int check(const char *tablename,
         } else if (rejinfo->with == IP6T_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
                 if (e->ipv6.proto != IPPROTO_TCP
-                    || (e->ipv6.invflags & IP6T_INV_PROTO)) {
+                    || (e->ipv6.invflags & XT_INV_PROTO)) {
                         DEBUGP("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
                         return 0;
                 }
@@ -242,8 +243,9 @@ static int check(const char *tablename,
         return 1;
 }
 
-static struct ip6t_target ip6t_reject_reg = {
+static struct xt_target ip6t_reject_reg = {
         .name           = "REJECT",
+        .family         = AF_INET6,
         .target         = reject6_target,
         .targetsize     = sizeof(struct ip6t_reject_info),
         .table          = "filter",
@@ -255,12 +257,12 @@ static struct ip6t_target ip6t_reject_reg = {
 
 static int __init ip6t_reject_init(void)
 {
-        return ip6t_register_target(&ip6t_reject_reg);
+        return xt_register_target(&ip6t_reject_reg);
 }
 
 static void __exit ip6t_reject_fini(void)
 {
-        ip6t_unregister_target(&ip6t_reject_reg);
+        xt_unregister_target(&ip6t_reject_reg);
 }
 
 module_init(ip6t_reject_init);
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 46486645eb75..d3c154371b41 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -15,6 +15,7 @@
 #include <net/checksum.h>
 #include <net/ipv6.h>
 
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_ipv6/ip6t_ah.h>
 
@@ -77,13 +78,13 @@ match(const struct sk_buff *skb,
 
         DEBUGP("IPv6 AH spi %02X ",
                (spi_match(ahinfo->spis[0], ahinfo->spis[1],
-                          ntohl(ah->spi),
-                          !!(ahinfo->invflags & IP6T_AH_INV_SPI))));
+                          ntohl(ah->spi),
+                          !!(ahinfo->invflags & IP6T_AH_INV_SPI))));
         DEBUGP("len %02X %04X %02X ",
                ahinfo->hdrlen, hdrlen,
                (!ahinfo->hdrlen ||
-                (ahinfo->hdrlen == hdrlen) ^
-                !!(ahinfo->invflags & IP6T_AH_INV_LEN)));
+                (ahinfo->hdrlen == hdrlen) ^
+                !!(ahinfo->invflags & IP6T_AH_INV_LEN)));
         DEBUGP("res %02X %04X %02X\n",
                ahinfo->hdrres, ah->reserved,
                !(ahinfo->hdrres && ah->reserved));
@@ -91,12 +92,12 @@ match(const struct sk_buff *skb,
         return (ah != NULL)
                &&
                (spi_match(ahinfo->spis[0], ahinfo->spis[1],
-                          ntohl(ah->spi),
-                          !!(ahinfo->invflags & IP6T_AH_INV_SPI)))
+                          ntohl(ah->spi),
+                          !!(ahinfo->invflags & IP6T_AH_INV_SPI)))
                &&
                (!ahinfo->hdrlen ||
-                (ahinfo->hdrlen == hdrlen) ^
-                !!(ahinfo->invflags & IP6T_AH_INV_LEN))
+                (ahinfo->hdrlen == hdrlen) ^
+                !!(ahinfo->invflags & IP6T_AH_INV_LEN))
                &&
                !(ahinfo->hdrres && ah->reserved);
 }
@@ -104,10 +105,10 @@ match(const struct sk_buff *skb,
 /* Called when user tries to insert an entry of this type. */
 static int
 checkentry(const char *tablename,
-          const void *entry,
+          const void *entry,
           const struct xt_match *match,
-          void *matchinfo,
-          unsigned int hook_mask)
+          void *matchinfo,
+          unsigned int hook_mask)
 {
         const struct ip6t_ah *ahinfo = matchinfo;
 
@@ -118,8 +119,9 @@ checkentry(const char *tablename,
         return 1;
 }
 
-static struct ip6t_match ah_match = {
+static struct xt_match ah_match = {
         .name           = "ah",
+        .family         = AF_INET6,
         .match          = match,
         .matchsize      = sizeof(struct ip6t_ah),
         .checkentry     = checkentry,
@@ -128,12 +130,12 @@ static struct ip6t_match ah_match = {
 
 static int __init ip6t_ah_init(void)
 {
-        return ip6t_register_match(&ah_match);
+        return xt_register_match(&ah_match);
 }
 
 static void __exit ip6t_ah_fini(void)
 {
-        ip6t_unregister_match(&ah_match);
+        xt_unregister_match(&ah_match);
 }
 
 module_init(ip6t_ah_init);
diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c
index 4f6b84c8f4ab..967bed71d4a8 100644
--- a/net/ipv6/netfilter/ip6t_eui64.c
+++ b/net/ipv6/netfilter/ip6t_eui64.c
@@ -12,6 +12,7 @@
 #include <linux/ipv6.h>
 #include <linux/if_ether.h>
 
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 
 MODULE_DESCRIPTION("IPv6 EUI64 address checking match");
@@ -61,8 +62,9 @@ match(const struct sk_buff *skb,
         return 0;
 }
 
-static struct ip6t_match eui64_match = {
+static struct xt_match eui64_match = {
         .name           = "eui64",
+        .family         = AF_INET6,
         .match          = match,
         .matchsize      = sizeof(int),
         .hooks          = (1 << NF_IP6_PRE_ROUTING) | (1 << NF_IP6_LOCAL_IN) |
@@ -72,12 +74,12 @@ static struct ip6t_match eui64_match = {
 
 static int __init ip6t_eui64_init(void)
 {
-        return ip6t_register_match(&eui64_match);
+        return xt_register_match(&eui64_match);
 }
 
 static void __exit ip6t_eui64_fini(void)
 {
-        ip6t_unregister_match(&eui64_match);
+        xt_unregister_match(&eui64_match);
 }
 
 module_init(ip6t_eui64_init);
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index cd22eaaccdca..5a5da71321b6 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -14,6 +14,7 @@
 #include <net/checksum.h>
 #include <net/ipv6.h>
 
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_ipv6/ip6t_frag.h>
 
@@ -135,8 +136,9 @@ checkentry(const char *tablename,
         return 1;
 }
 
-static struct ip6t_match frag_match = {
+static struct xt_match frag_match = {
         .name           = "frag",
+        .family         = AF_INET6,
         .match          = match,
         .matchsize      = sizeof(struct ip6t_frag),
         .checkentry     = checkentry,
@@ -145,12 +147,12 @@ static struct ip6t_match frag_match = {
 
 static int __init ip6t_frag_init(void)
 {
-        return ip6t_register_match(&frag_match);
+        return xt_register_match(&frag_match);
 }
 
 static void __exit ip6t_frag_fini(void)
 {
-        ip6t_unregister_match(&frag_match);
+        xt_unregister_match(&frag_match);
 }
 
 module_init(ip6t_frag_init);
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 3f25babe0440..d2373c7cd354 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -16,6 +16,7 @@
 
 #include <asm/byteorder.h>
 
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_ipv6/ip6t_opts.h>
 
diff --git a/net/ipv6/netfilter/ip6t_hl.c b/net/ipv6/netfilter/ip6t_hl.c
index 44a729e17c48..37c8a4d4ed78 100644
--- a/net/ipv6/netfilter/ip6t_hl.c
+++ b/net/ipv6/netfilter/ip6t_hl.c
@@ -8,11 +8,12 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/ipv6.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 
 #include <linux/netfilter_ipv6/ip6t_hl.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter/x_tables.h>
 
 MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
 MODULE_DESCRIPTION("IP tables Hop Limit matching module");
@@ -40,7 +41,7 @@ static int match(const struct sk_buff *skb,
                         return (ip6h->hop_limit > info->hop_limit);
                         break;
                 default:
-                        printk(KERN_WARNING "ip6t_hl: unknown mode %d\n", 
+                        printk(KERN_WARNING "ip6t_hl: unknown mode %d\n",
                                 info->mode);
                         return 0;
         }
@@ -48,8 +49,9 @@ static int match(const struct sk_buff *skb,
         return 0;
 }
 
-static struct ip6t_match hl_match = {
+static struct xt_match hl_match = {
         .name           = "hl",
+        .family         = AF_INET6,
         .match          = match,
         .matchsize      = sizeof(struct ip6t_hl_info),
         .me             = THIS_MODULE,
@@ -57,13 +59,12 @@ static struct ip6t_match hl_match = {
 
 static int __init ip6t_hl_init(void)
 {
-        return ip6t_register_match(&hl_match);
+        return xt_register_match(&hl_match);
 }
 
 static void __exit ip6t_hl_fini(void)
 {
-        ip6t_unregister_match(&hl_match);
-
+        xt_unregister_match(&hl_match);
 }
 
 module_init(ip6t_hl_init);
diff --git a/net/ipv6/netfilter/ip6t_ipv6header.c b/net/ipv6/netfilter/ip6t_ipv6header.c
index 3093c398002f..700a11d25deb 100644
--- a/net/ipv6/netfilter/ip6t_ipv6header.c
+++ b/net/ipv6/netfilter/ip6t_ipv6header.c
@@ -1,7 +1,7 @@
 /* ipv6header match - matches IPv6 packets based
    on whether they contain certain headers */
 
-/* Original idea: Brad Chapman 
+/* Original idea: Brad Chapman
  * Rewritten by: Andras Kis-Szabo <kisza@sch.bme.hu> */
 
 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
@@ -18,6 +18,7 @@
 #include <net/checksum.h>
 #include <net/ipv6.h>
 
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_ipv6/ip6t_ipv6header.h>
 
@@ -140,8 +141,9 @@ ipv6header_checkentry(const char *tablename,
         return 1;
 }
 
-static struct ip6t_match ip6t_ipv6header_match = {
+static struct xt_match ip6t_ipv6header_match = {
         .name           = "ipv6header",
+        .family         = AF_INET6,
         .match          = &ipv6header_match,
         .matchsize      = sizeof(struct ip6t_ipv6header_info),
         .checkentry     = &ipv6header_checkentry,
@@ -151,12 +153,12 @@ static struct ip6t_match ip6t_ipv6header_match = {
 
 static int __init ipv6header_init(void)
 {
-        return ip6t_register_match(&ip6t_ipv6header_match);
+        return xt_register_match(&ip6t_ipv6header_match);
 }
 
 static void __exit ipv6header_exit(void)
 {
-        ip6t_unregister_match(&ip6t_ipv6header_match);
+        xt_unregister_match(&ip6t_ipv6header_match);
 }
 
 module_init(ipv6header_init);
diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c
new file mode 100644
index 000000000000..c2a909893a64
--- /dev/null
+++ b/net/ipv6/netfilter/ip6t_mh.c
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C)2006 USAGI/WIDE Project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Author:
+ *      Masahide NAKAMURA @USAGI <masahide.nakamura.cz@hitachi.com>
+ *
+ * Based on net/netfilter/xt_tcpudp.c
+ *
+ */
+#include <linux/types.h>
+#include <linux/module.h>
+#include <net/ip.h>
+#include <linux/ipv6.h>
+#include <net/ipv6.h>
+#include <net/mip6.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv6/ip6t_mh.h>
+
+MODULE_DESCRIPTION("ip6t_tables match for MH");
+MODULE_LICENSE("GPL");
+
+#ifdef DEBUG_IP_FIREWALL_USER
+#define duprintf(format, args...) printk(format , ## args)
+#else
+#define duprintf(format, args...)
+#endif
+
+/* Returns 1 if the type is matched by the range, 0 otherwise */
+static inline int
+type_match(u_int8_t min, u_int8_t max, u_int8_t type, int invert)
+{
+        int ret;
+
+        ret = (type >= min && type <= max) ^ invert;
+        return ret;
+}
+
+static int
+match(const struct sk_buff *skb,
+         const struct net_device *in,
+         const struct net_device *out,
+         const struct xt_match *match,
+         const void *matchinfo,
+         int offset,
+         unsigned int protoff,
+         int *hotdrop)
+{
+        struct ip6_mh _mh, *mh;
+        const struct ip6t_mh *mhinfo = matchinfo;
+
+        /* Must not be a fragment. */
+        if (offset)
+                return 0;
+
+        mh = skb_header_pointer(skb, protoff, sizeof(_mh), &_mh);
+        if (mh == NULL) {
+                /* We've been asked to examine this packet, and we
+                   can't.  Hence, no choice but to drop. */
+                duprintf("Dropping evil MH tinygram.\n");
+                *hotdrop = 1;
+                return 0;
+        }
+
+        if (mh->ip6mh_proto != IPPROTO_NONE) {
+                duprintf("Dropping invalid MH Payload Proto: %u\n",
+                         mh->ip6mh_proto);
+                *hotdrop = 1;
+                return 0;
+        }
+
+        return type_match(mhinfo->types[0], mhinfo->types[1], mh->ip6mh_type,
+                          !!(mhinfo->invflags & IP6T_MH_INV_TYPE));
+}
+
+/* Called when user tries to insert an entry of this type. */
+static int
+mh_checkentry(const char *tablename,
+              const void *entry,
+              const struct xt_match *match,
+              void *matchinfo,
+              unsigned int hook_mask)
+{
+        const struct ip6t_mh *mhinfo = matchinfo;
+
+        /* Must specify no unknown invflags */
+        return !(mhinfo->invflags & ~IP6T_MH_INV_MASK);
+}
+
+static struct xt_match mh_match = {
+        .name           = "mh",
+        .family         = AF_INET6,
+        .checkentry     = mh_checkentry,
+        .match          = match,
+        .matchsize      = sizeof(struct ip6t_mh),
+        .proto          = IPPROTO_MH,
+        .me             = THIS_MODULE,
+};
+
+static int __init ip6t_mh_init(void)
+{
+        return xt_register_match(&mh_match);
+}
+
+static void __exit ip6t_mh_fini(void)
+{
+        xt_unregister_match(&mh_match);
+}
+
+module_init(ip6t_mh_init);
+module_exit(ip6t_mh_fini);
diff --git a/net/ipv6/netfilter/ip6t_owner.c b/net/ipv6/netfilter/ip6t_owner.c
index 4eb9bbc4ebc3..43738bba00b5 100644
--- a/net/ipv6/netfilter/ip6t_owner.c
+++ b/net/ipv6/netfilter/ip6t_owner.c
@@ -16,6 +16,7 @@
 
 #include <linux/netfilter_ipv6/ip6t_owner.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter/x_tables.h>
 
 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
 MODULE_DESCRIPTION("IP6 tables owner matching module");
@@ -69,8 +70,9 @@ checkentry(const char *tablename,
         return 1;
 }
 
-static struct ip6t_match owner_match = {
+static struct xt_match owner_match = {
         .name           = "owner",
+        .family         = AF_INET6,
         .match          = match,
         .matchsize      = sizeof(struct ip6t_owner_info),
         .hooks          = (1 << NF_IP6_LOCAL_OUT) | (1 << NF_IP6_POST_ROUTING),
@@ -80,12 +82,12 @@ static struct ip6t_match owner_match = {
 
 static int __init ip6t_owner_init(void)
 {
-        return ip6t_register_match(&owner_match);
+        return xt_register_match(&owner_match);
 }
 
 static void __exit ip6t_owner_fini(void)
 {
-        ip6t_unregister_match(&owner_match);
+        xt_unregister_match(&owner_match);
 }
 
 module_init(ip6t_owner_init);
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 54d7d14134fd..81ab00d8c182 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -16,6 +16,7 @@
 
 #include <asm/byteorder.h>
 
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_ipv6/ip6t_rt.h>
 
@@ -221,8 +222,9 @@ checkentry(const char *tablename,
         return 1;
 }
 
-static struct ip6t_match rt_match = {
+static struct xt_match rt_match = {
         .name           = "rt",
+        .family         = AF_INET6,
         .match          = match,
         .matchsize      = sizeof(struct ip6t_rt),
         .checkentry     = checkentry,
@@ -231,12 +233,12 @@ static struct ip6t_match rt_match = {
 
 static int __init ip6t_rt_init(void)
 {
-        return ip6t_register_match(&rt_match);
+        return xt_register_match(&rt_match);
 }
 
 static void __exit ip6t_rt_fini(void)
 {
-        ip6t_unregister_match(&rt_match);
+        xt_unregister_match(&rt_match);
 }
 
 module_init(ip6t_rt_init);
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 2fc07c74decf..112a21d0c6da 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -19,25 +19,6 @@ MODULE_DESCRIPTION("ip6tables filter table");
 
 #define FILTER_VALID_HOOKS ((1 << NF_IP6_LOCAL_IN) | (1 << NF_IP6_FORWARD) | (1 << NF_IP6_LOCAL_OUT))
 
-/* Standard entry. */
-struct ip6t_standard
-{
-        struct ip6t_entry entry;
-        struct ip6t_standard_target target;
-};
-
-struct ip6t_error_target
-{
-        struct ip6t_entry_target target;
-        char errorname[IP6T_FUNCTION_MAXNAMELEN];
-};
-
-struct ip6t_error
-{
-        struct ip6t_entry entry;
-        struct ip6t_error_target target;
-};
-
 static struct
 {
         struct ip6t_replace repl;
@@ -92,7 +73,7 @@ static struct
     }
 };
 
-static struct ip6t_table packet_filter = {
+static struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .lock           = RW_LOCK_UNLOCKED,
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 6250e86a6ddc..0c468d35a937 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -29,25 +29,6 @@ MODULE_DESCRIPTION("ip6tables mangle table");
 #define DEBUGP(x, args...)
 #endif
 
-/* Standard entry. */
-struct ip6t_standard
-{
-        struct ip6t_entry entry;
-        struct ip6t_standard_target target;
-};
-
-struct ip6t_error_target
-{
-        struct ip6t_entry_target target;
-        char errorname[IP6T_FUNCTION_MAXNAMELEN];
-};
-
-struct ip6t_error
-{
-        struct ip6t_entry entry;
-        struct ip6t_error_target target;
-};
-
 static struct
 {
         struct ip6t_replace repl;
@@ -69,7 +50,7 @@ static struct
       0, NULL, { } },
     {
             /* PRE_ROUTING */
-            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
+            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
                 0,
                 sizeof(struct ip6t_entry),
                 sizeof(struct ip6t_standard),
@@ -77,7 +58,7 @@ static struct
               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
                 -NF_ACCEPT - 1 } },
             /* LOCAL_IN */
-            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
+            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
                 0,
                 sizeof(struct ip6t_entry),
                 sizeof(struct ip6t_standard),
@@ -85,7 +66,7 @@ static struct
               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
                 -NF_ACCEPT - 1 } },
             /* FORWARD */
-            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
+            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
                 0,
                 sizeof(struct ip6t_entry),
                 sizeof(struct ip6t_standard),
@@ -93,7 +74,7 @@ static struct
               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
                 -NF_ACCEPT - 1 } },
             /* LOCAL_OUT */
-            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
+            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
                 0,
                 sizeof(struct ip6t_entry),
                 sizeof(struct ip6t_standard),
@@ -122,7 +103,7 @@ static struct
     }
 };
 
-static struct ip6t_table packet_mangler = {
+static struct xt_table packet_mangler = {
         .name           = "mangle",
         .valid_hooks    = MANGLE_VALID_HOOKS,
         .lock           = RW_LOCK_UNLOCKED,
@@ -175,7 +156,7 @@ ip6t_local_hook(unsigned int hook,
 
         ret = ip6t_do_table(pskb, hook, in, out, &packet_mangler);
 
-        if (ret != NF_DROP && ret != NF_STOLEN 
+        if (ret != NF_DROP && ret != NF_STOLEN
                 && (memcmp(&(*pskb)->nh.ipv6h->saddr, &saddr, sizeof(saddr))
                     || memcmp(&(*pskb)->nh.ipv6h->daddr, &daddr, sizeof(daddr))
                     || (*pskb)->mark != mark
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index b4154da575c0..a3eb5b8ce18d 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -14,25 +14,6 @@
 #define DEBUGP(x, args...)
 #endif
 
-/* Standard entry. */
-struct ip6t_standard
-{
-        struct ip6t_entry entry;
-        struct ip6t_standard_target target;
-};
-
-struct ip6t_error_target
-{
-        struct ip6t_entry_target target;
-        char errorname[IP6T_FUNCTION_MAXNAMELEN];
-};
-
-struct ip6t_error
-{
-        struct ip6t_entry entry;
-        struct ip6t_error_target target;
-};
-
 static struct
 {
         struct ip6t_replace repl;
@@ -106,10 +87,10 @@ static struct
         }
 };
 
-static struct xt_table packet_raw = { 
-        .name = "raw", 
-        .valid_hooks = RAW_VALID_HOOKS, 
-        .lock = RW_LOCK_UNLOCKED, 
+static struct xt_table packet_raw = {
+        .name = "raw",
+        .valid_hooks = RAW_VALID_HOOKS,
+        .lock = RW_LOCK_UNLOCKED,
         .me = THIS_MODULE,
         .af = AF_INET6,
 };
@@ -125,17 +106,17 @@ ip6t_hook(unsigned int hook,
         return ip6t_do_table(pskb, hook, in, out, &packet_raw);
 }
 
-static struct nf_hook_ops ip6t_ops[] = { 
+static struct nf_hook_ops ip6t_ops[] = {
         {
-          .hook = ip6t_hook, 
+          .hook = ip6t_hook,
           .pf = PF_INET6,
           .hooknum = NF_IP6_PRE_ROUTING,
           .priority = NF_IP6_PRI_FIRST,
           .owner = THIS_MODULE,
         },
         {
-          .hook = ip6t_hook, 
-          .pf = PF_INET6, 
+          .hook = ip6t_hook,
+          .pf = PF_INET6,
           .hooknum = NF_IP6_LOCAL_OUT,
           .priority = NF_IP6_PRI_FIRST,
           .owner = THIS_MODULE,
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index a20615ffccff..4b7be4bb4d03 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -154,8 +154,8 @@ ipv6_prepare(struct sk_buff **pskb, unsigned int hooknum, unsigned int *dataoff,
          */
         if ((protoff < 0) || (protoff > (*pskb)->len)) {
                 DEBUGP("ip6_conntrack_core: can't find proto in pkt\n");
-                NF_CT_STAT_INC(error);
-                NF_CT_STAT_INC(invalid);
+                NF_CT_STAT_INC_ATOMIC(error);
+                NF_CT_STAT_INC_ATOMIC(invalid);
                 return -NF_ACCEPT;
         }
 
@@ -349,7 +349,7 @@ static ctl_table nf_ct_ipv6_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
         },
-        { .ctl_name = 0 }
+        { .ctl_name = 0 }
 };
 #endif
 
@@ -386,7 +386,7 @@ static int ipv6_nfattr_to_tuple(struct nfattr *tb[],
         if (nfattr_bad_size(tb, CTA_IP_MAX, cta_min_ip))
                 return -EINVAL;
 
-        memcpy(&t->src.u3.ip6, NFA_DATA(tb[CTA_IP_V6_SRC-1]), 
+        memcpy(&t->src.u3.ip6, NFA_DATA(tb[CTA_IP_V6_SRC-1]),
                sizeof(u_int32_t) * 4);
         memcpy(&t->dst.u3.ip6, NFA_DATA(tb[CTA_IP_V6_DST-1]),
                sizeof(u_int32_t) * 4);
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 3905cacc69af..19bdb7cb8ff3 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -104,9 +104,9 @@ static int icmpv6_packet(struct nf_conn *ct,
                        unsigned int hooknum)
 {
         /* Try to delete connection immediately after all replies:
-           won't actually vanish as we still have skb, and del_timer
-           means this will only run once even if count hits zero twice
-           (theoretically possible with SMP) */
+           won't actually vanish as we still have skb, and del_timer
+           means this will only run once even if count hits zero twice
+           (theoretically possible with SMP) */
         if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
                 if (atomic_dec_and_test(&ct->proto.icmp.count)
                     && del_timer(&ct->timeout))
@@ -182,6 +182,7 @@ icmpv6_error_message(struct sk_buff *skb,
                 return -NF_ACCEPT;
         }
 
+        /* rcu_read_lock()ed by nf_hook_slow */
         inproto = __nf_ct_l4proto_find(PF_INET6, inprotonum);
 
         /* Are they talking about one of our connections? */
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index d9c15402ba66..15ab1e3e8b56 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -311,7 +311,7 @@ static struct nf_ct_frag6_queue *nf_ct_frag6_intern(unsigned int hash,
         write_lock(&nf_ct_frag6_lock);
 #ifdef CONFIG_SMP
         hlist_for_each_entry(fq, n, &nf_ct_frag6_hash[hash], list) {
-                if (fq->id == fq_in->id && 
+                if (fq->id == fq_in->id &&
                     ipv6_addr_equal(&fq_in->saddr, &fq->saddr) &&
                     ipv6_addr_equal(&fq_in->daddr, &fq->daddr)) {
                         atomic_inc(&fq->refcnt);
@@ -374,7 +374,7 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
 
         read_lock(&nf_ct_frag6_lock);
         hlist_for_each_entry(fq, n, &nf_ct_frag6_hash[hash], list) {
-                if (fq->id == id && 
+                if (fq->id == id &&
                     ipv6_addr_equal(src, &fq->saddr) &&
                     ipv6_addr_equal(dst, &fq->daddr)) {
                         atomic_inc(&fq->refcnt);
@@ -388,7 +388,7 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
 }
 
 
-static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb, 
+static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                              struct frag_hdr *fhdr, int nhoff)
 {
         struct sk_buff *prev, *next;
@@ -405,12 +405,12 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
 
         if ((unsigned int)end > IPV6_MAXPLEN) {
                 DEBUGP("offset is too large.\n");
-                return -1;
+                return -1;
         }
 
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_sub(skb->csum,
-                                     csum_partial(skb->nh.raw,
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
+                skb->csum = csum_sub(skb->csum,
+                                     csum_partial(skb->nh.raw,
                                                   (u8*)(fhdr + 1) - skb->nh.raw,
                                                   0));
 
@@ -625,7 +625,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
         /* We have to remove fragment header from datagram and to relocate
          * header in order to calculate ICV correctly. */
         head->nh.raw[fq->nhoffset] = head->h.raw[0];
-        memmove(head->head + sizeof(struct frag_hdr), head->head, 
+        memmove(head->head + sizeof(struct frag_hdr), head->head,
                 (head->data - head->head) - sizeof(struct frag_hdr));
         head->mac.raw += sizeof(struct frag_hdr);
         head->nh.raw += sizeof(struct frag_hdr);
@@ -701,41 +701,41 @@ out_fail:
 static int
 find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
 {
-        u8 nexthdr = skb->nh.ipv6h->nexthdr;
+        u8 nexthdr = skb->nh.ipv6h->nexthdr;
         u8 prev_nhoff = (u8 *)&skb->nh.ipv6h->nexthdr - skb->data;
         int start = (u8 *)(skb->nh.ipv6h+1) - skb->data;
         int len = skb->len - start;
         u8 prevhdr = NEXTHDR_IPV6;
 
-        while (nexthdr != NEXTHDR_FRAGMENT) {
-                struct ipv6_opt_hdr hdr;
-                int hdrlen;
+        while (nexthdr != NEXTHDR_FRAGMENT) {
+                struct ipv6_opt_hdr hdr;
+                int hdrlen;
 
                 if (!ipv6_ext_hdr(nexthdr)) {
                         return -1;
                 }
-                if (len < (int)sizeof(struct ipv6_opt_hdr)) {
+                if (len < (int)sizeof(struct ipv6_opt_hdr)) {
                         DEBUGP("too short\n");
                         return -1;
                 }
-                if (nexthdr == NEXTHDR_NONE) {
+                if (nexthdr == NEXTHDR_NONE) {
                         DEBUGP("next header is none\n");
                         return -1;
                 }
-                if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
-                        BUG();
-                if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hdr.hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(&hdr);
+                if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
+                        BUG();
+                if (nexthdr == NEXTHDR_AUTH)
+                        hdrlen = (hdr.hdrlen+2)<<2;
+                else
+                        hdrlen = ipv6_optlen(&hdr);
 
                 prevhdr = nexthdr;
                 prev_nhoff = start;
 
-                nexthdr = hdr.nexthdr;
-                len -= hdrlen;
-                start += hdrlen;
-        }
+                nexthdr = hdr.nexthdr;
+                len -= hdrlen;
+                start += hdrlen;
+        }
 
         if (len < 0)
                 return -1;
@@ -749,7 +749,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
 
 struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
 {
-        struct sk_buff *clone; 
+        struct sk_buff *clone;
         struct net_device *dev = skb->dev;
         struct frag_hdr *fhdr;
         struct nf_ct_frag6_queue *fq;
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 35249d8487bb..c82257dd04b6 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -50,7 +50,7 @@ static int sockstat6_seq_show(struct seq_file *seq, void *v)
         seq_printf(seq, "UDP6: inuse %d\n",
                        fold_prot_inuse(&udpv6_prot));
         seq_printf(seq, "UDPLITE6: inuse %d\n",
-                        fold_prot_inuse(&udplitev6_prot));
+                        fold_prot_inuse(&udplitev6_prot));
         seq_printf(seq, "RAW6: inuse %d\n",
                        fold_prot_inuse(&rawv6_prot));
         seq_printf(seq, "FRAG6: inuse %d memory %d\n",
@@ -89,7 +89,7 @@ static struct snmp_mib snmp6_icmp6_list[] = {
 /* icmpv6 mib according to RFC 2466
 
    Exceptions:  {In|Out}AdminProhibs are removed, because I see
-                no good reasons to account them separately
+                no good reasons to account them separately
                 of another dest.unreachs.
                 OutErrs is zero identically.
                 OutEchos too.
@@ -146,14 +146,14 @@ static struct snmp_mib snmp6_udplite6_list[] = {
 static unsigned long
 fold_field(void *mib[], int offt)
 {
-        unsigned long res = 0;
-        int i;
- 
-        for_each_possible_cpu(i) {
-                res += *(((unsigned long *)per_cpu_ptr(mib[0], i)) + offt);
-                res += *(((unsigned long *)per_cpu_ptr(mib[1], i)) + offt);
-        }
-        return res;
+        unsigned long res = 0;
+        int i;
+
+        for_each_possible_cpu(i) {
+                res += *(((unsigned long *)per_cpu_ptr(mib[0], i)) + offt);
+                res += *(((unsigned long *)per_cpu_ptr(mib[1], i)) + offt);
+        }
+        return res;
 }
 
 static inline void
@@ -161,7 +161,7 @@ snmp6_seq_show_item(struct seq_file *seq, void **mib, struct snmp_mib *itemlist)
 {
         int i;
         for (i=0; itemlist[i].name; i++)
-                seq_printf(seq, "%-32s\t%lu\n", itemlist[i].name, 
+                seq_printf(seq, "%-32s\t%lu\n", itemlist[i].name,
                                 fold_field(mib, itemlist[i].entry));
 }
 
@@ -187,7 +187,7 @@ static int sockstat6_seq_open(struct inode *inode, struct file *file)
         return single_open(file, sockstat6_seq_show, NULL);
 }
 
-static struct file_operations sockstat6_seq_fops = {
+static const struct file_operations sockstat6_seq_fops = {
         .owner   = THIS_MODULE,
         .open    = sockstat6_seq_open,
         .read    = seq_read,
@@ -200,7 +200,7 @@ static int snmp6_seq_open(struct inode *inode, struct file *file)
         return single_open(file, snmp6_seq_show, PDE(inode)->data);
 }
 
-static struct file_operations snmp6_seq_fops = {
+static const struct file_operations snmp6_seq_fops = {
         .owner   = THIS_MODULE,
         .open    = snmp6_seq_open,
         .read    = seq_read,
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 52c1d58b6ca6..ad0410c99675 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -64,7 +64,7 @@ int inet6_add_protocol(struct inet6_protocol *prot, unsigned char protocol)
 /*
  *      Remove a protocol from the hash tables.
  */
- 
+
 int inet6_del_protocol(struct inet6_protocol *prot, unsigned char protocol)
 {
         int ret, hash = protocol & (MAX_INET_PROTOS - 1);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4ae1b19ada5d..1f8f6275a7e4 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1,9 +1,9 @@
 /*
  *      RAW sockets for IPv6
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      Adapted from linux/net/ipv4/raw.c
  *
@@ -11,7 +11,7 @@
  *
  *      Fixes:
  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
- *      YOSHIFUJI,H.@USAGI      :       raw checksum (RFC2292(bis) compliance) 
+ *      YOSHIFUJI,H.@USAGI      :       raw checksum (RFC2292(bis) compliance)
  *      Kazunori MIYAZAWA @USAGI:       change process style to use ip6_append_data
  *
  *      This program is free software; you can redistribute it and/or
@@ -71,12 +71,12 @@ static void raw_v6_hash(struct sock *sk)
         write_lock_bh(&raw_v6_lock);
         sk_add_node(sk, list);
         sock_prot_inc_use(sk->sk_prot);
-        write_unlock_bh(&raw_v6_lock);
+        write_unlock_bh(&raw_v6_lock);
 }
 
 static void raw_v6_unhash(struct sock *sk)
 {
-        write_lock_bh(&raw_v6_lock);
+        write_lock_bh(&raw_v6_lock);
         if (sk_del_node_init(sk))
                 sock_prot_dec_use(sk->sk_prot);
         write_unlock_bh(&raw_v6_lock);
@@ -250,7 +250,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                  */
                                 sk->sk_bound_dev_if = addr->sin6_scope_id;
                         }
-                        
+
                         /* Binding to link-local address requires an interface */
                         if (!sk->sk_bound_dev_if)
                                 goto out;
@@ -261,7 +261,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                 goto out;
                         }
                 }
-                
+
                 /* ipv4 addr of the socket is invalid.  Only the
                  * unspecified and mapped address have a v4 equivalent.
                  */
@@ -324,7 +324,7 @@ void rawv6_err(struct sock *sk, struct sk_buff *skb,
 
 static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
 {
-        if ((raw6_sk(sk)->checksum || sk->sk_filter) && 
+        if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
             skb_checksum_complete(skb)) {
                 /* FIXME: increment a raw6 drops counter here */
                 kfree_skb(skb);
@@ -342,10 +342,10 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
 }
 
 /*
- *      This is next to useless... 
+ *      This is next to useless...
  *      if we demultiplex in network layer we don't need the extra call
- *      just to queue the skb... 
- *      maybe we could have the network decide upon a hint if it 
+ *      just to queue the skb...
+ *      maybe we could have the network decide upon a hint if it
  *      should call raw_rcv for demultiplexing
  */
 int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
@@ -353,17 +353,17 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
         struct inet_sock *inet = inet_sk(sk);
         struct raw6_sock *rp = raw6_sk(sk);
 
-        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
-                kfree_skb(skb);
-                return NET_RX_DROP;
-        }
+        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
+                kfree_skb(skb);
+                return NET_RX_DROP;
+        }
 
         if (!rp->checksum)
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 
         if (skb->ip_summed == CHECKSUM_COMPLETE) {
                 skb_postpull_rcsum(skb, skb->nh.raw,
-                                   skb->h.raw - skb->nh.raw);
+                                   skb->h.raw - skb->nh.raw);
                 if (!csum_ipv6_magic(&skb->nh.ipv6h->saddr,
                                      &skb->nh.ipv6h->daddr,
                                      skb->len, inet->num, skb->csum))
@@ -404,8 +404,8 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
 
         if (flags & MSG_OOB)
                 return -EOPNOTSUPP;
-                
-        if (addr_len) 
+
+        if (addr_len)
                 *addr_len=sizeof(*sin6);
 
         if (flags & MSG_ERRQUEUE)
@@ -416,10 +416,10 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                 goto out;
 
         copied = skb->len;
-        if (copied > len) {
-                copied = len;
-                msg->msg_flags |= MSG_TRUNC;
-        }
+        if (copied > len) {
+                copied = len;
+                msg->msg_flags |= MSG_TRUNC;
+        }
 
         if (skb->ip_summed==CHECKSUM_UNNECESSARY) {
                 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
@@ -549,7 +549,7 @@ out:
 }
 
 static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
-                        struct flowi *fl, struct rt6_info *rt, 
+                        struct flowi *fl, struct rt6_info *rt,
                         unsigned int flags)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -570,7 +570,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
         skb = sock_alloc_send_skb(sk, length+hh_len+15,
                                   flags&MSG_DONTWAIT, &err);
         if (skb == NULL)
-                goto error; 
+                goto error;
         skb_reserve(skb, hh_len);
 
         skb->priority = sk->sk_priority;
@@ -600,7 +600,7 @@ error_fault:
         kfree_skb(skb);
 error:
         IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
-        return err; 
+        return err;
 }
 
 static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
@@ -694,19 +694,19 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 return -EMSGSIZE;
 
         /* Mirror BSD error message compatibility */
-        if (msg->msg_flags & MSG_OOB)           
+        if (msg->msg_flags & MSG_OOB)
                 return -EOPNOTSUPP;
 
         /*
-         *      Get and verify the address. 
+         *      Get and verify the address.
          */
         memset(&fl, 0, sizeof(fl));
 
         if (sin6) {
-                if (addr_len < SIN6_LEN_RFC2133) 
+                if (addr_len < SIN6_LEN_RFC2133)
                         return -EINVAL;
 
-                if (sin6->sin6_family && sin6->sin6_family != AF_INET6) 
+                if (sin6->sin6_family && sin6->sin6_family != AF_INET6)
                         return(-EAFNOSUPPORT);
 
                 /* port is the proto value [0..255] carried in nexthdr */
@@ -744,17 +744,17 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                     ipv6_addr_type(daddr)&IPV6_ADDR_LINKLOCAL)
                         fl.oif = sin6->sin6_scope_id;
         } else {
-                if (sk->sk_state != TCP_ESTABLISHED) 
+                if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
-                
+
                 proto = inet->num;
                 daddr = &np->daddr;
                 fl.fl6_flowlabel = np->flow_label;
         }
 
         if (ipv6_addr_any(daddr)) {
-                /* 
-                 * unspecified destination address 
+                /*
+                 * unspecified destination address
                  * treated as error... is this correct ?
                  */
                 fl6_sock_release(flowlabel);
@@ -792,7 +792,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         err = rawv6_probe_proto_opt(&fl, msg);
         if (err)
                 goto out;
- 
+
         ipv6_addr_copy(&fl.fl6_dst, daddr);
         if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
                 ipv6_addr_copy(&fl.fl6_src, &np->saddr);
@@ -815,7 +815,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+        if ((err = xfrm_lookup(&dst, &fl, sk, 1)) < 0)
                 goto out;
 
         if (hlimit < 0) {
@@ -856,7 +856,7 @@ done:
         dst_release(dst);
         if (!inet->hdrincl)
                 release_sock(sk);
-out:    
+out:
         fl6_sock_release(flowlabel);
         return err<0?err:len;
 do_confirm:
@@ -867,7 +867,7 @@ do_confirm:
         goto done;
 }
 
-static int rawv6_seticmpfilter(struct sock *sk, int level, int optname, 
+static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
                                char __user *optval, int optlen)
 {
         switch (optname) {
@@ -884,7 +884,7 @@ static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
         return 0;
 }
 
-static int rawv6_geticmpfilter(struct sock *sk, int level, int optname, 
+static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
                                char __user *optval, int __user *optlen)
 {
         int len;
@@ -916,7 +916,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
         struct raw6_sock *rp = raw6_sk(sk);
         int val;
 
-        if (get_user(val, (int __user *)optval))
+        if (get_user(val, (int __user *)optval))
                 return -EFAULT;
 
         switch (optname) {
@@ -1094,10 +1094,19 @@ static void rawv6_close(struct sock *sk, long timeout)
 
 static int rawv6_init_sk(struct sock *sk)
 {
-        if (inet_sk(sk)->num == IPPROTO_ICMPV6) {
-                struct raw6_sock *rp = raw6_sk(sk);
+        struct raw6_sock *rp = raw6_sk(sk);
+
+        switch (inet_sk(sk)->num) {
+        case IPPROTO_ICMPV6:
                 rp->checksum = 1;
                 rp->offset   = 2;
+                break;
+        case IPPROTO_MH:
+                rp->checksum = 1;
+                rp->offset   = 4;
+                break;
+        default:
+                break;
         }
         return(0);
 }
@@ -1215,7 +1224,7 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
                    dest->s6_addr32[0], dest->s6_addr32[1],
                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
-                   sp->sk_state, 
+                   sp->sk_state,
                    atomic_read(&sp->sk_wmem_alloc),
                    atomic_read(&sp->sk_rmem_alloc),
                    0, 0L, 0,
@@ -1264,7 +1273,7 @@ out_kfree:
         goto out;
 }
 
-static struct file_operations raw6_seq_fops = {
+static const struct file_operations raw6_seq_fops = {
         .owner =        THIS_MODULE,
         .open =         raw6_seq_open,
         .read =         seq_read,
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 6f9a9046510f..7034c54e5010 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -1,9 +1,9 @@
 /*
  *      IPv6 fragment reassembly
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      $Id: reassembly.c,v 1.26 2001/03/07 22:00:57 davem Exp $
  *
@@ -15,8 +15,8 @@
  *      2 of the License, or (at your option) any later version.
  */
 
-/* 
- *      Fixes:  
+/*
+ *      Fixes:
  *      Andi Kleen      Make it work with multiple hosts.
  *                      More RFC compliance.
  *
@@ -343,7 +343,7 @@ static struct frag_queue *ip6_frag_intern(struct frag_queue *fq_in)
         hash = ip6qhashfn(fq_in->id, &fq_in->saddr, &fq_in->daddr);
 #ifdef CONFIG_SMP
         hlist_for_each_entry(fq, n, &ip6_frag_hash[hash], list) {
-                if (fq->id == fq_in->id && 
+                if (fq->id == fq_in->id &&
                     ipv6_addr_equal(&fq_in->saddr, &fq->saddr) &&
                     ipv6_addr_equal(&fq_in->daddr, &fq->daddr)) {
                         atomic_inc(&fq->refcnt);
@@ -406,7 +406,7 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst,
         read_lock(&ip6_frag_lock);
         hash = ip6qhashfn(id, src, dst);
         hlist_for_each_entry(fq, n, &ip6_frag_hash[hash], list) {
-                if (fq->id == id && 
+                if (fq->id == id &&
                     ipv6_addr_equal(src, &fq->saddr) &&
                     ipv6_addr_equal(dst, &fq->daddr)) {
                         atomic_inc(&fq->refcnt);
@@ -420,7 +420,7 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst,
 }
 
 
-static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, 
+static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                            struct frag_hdr *fhdr, int nhoff)
 {
         struct sk_buff *prev, *next;
@@ -436,13 +436,13 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         if ((unsigned int)end > IPV6_MAXPLEN) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb,ICMPV6_HDR_FIELD, (u8*)&fhdr->frag_off - skb->nh.raw);
-                return;
+                icmpv6_param_prob(skb,ICMPV6_HDR_FIELD, (u8*)&fhdr->frag_off - skb->nh.raw);
+                return;
         }
 
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_sub(skb->csum,
-                                     csum_partial(skb->nh.raw, (u8*)(fhdr+1)-skb->nh.raw, 0));
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
+                skb->csum = csum_sub(skb->csum,
+                                     csum_partial(skb->nh.raw, (u8*)(fhdr+1)-skb->nh.raw, 0));
 
         /* Is this the final fragment? */
         if (!(fhdr->frag_off & htons(IP6_MF))) {
@@ -464,7 +464,7 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                          */
                         IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                          IPSTATS_MIB_INHDRERRORS);
-                        icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, 
+                        icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
                                           offsetof(struct ipv6hdr, payload_len));
                         return;
                 }
@@ -482,7 +482,7 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         /* Point into the IP datagram 'data' part. */
         if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
                 goto err;
-        
+
         if (pskb_trim_rcsum(skb, end - offset))
                 goto err;
 
@@ -640,7 +640,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
          * header in order to calculate ICV correctly. */
         nhoff = fq->nhoffset;
         head->nh.raw[nhoff] = head->h.raw[0];
-        memmove(head->head + sizeof(struct frag_hdr), head->head, 
+        memmove(head->head + sizeof(struct frag_hdr), head->head,
                 (head->data - head->head) - sizeof(struct frag_hdr));
         head->mac.raw += sizeof(struct frag_hdr);
         head->nh.raw += sizeof(struct frag_hdr);
@@ -695,7 +695,7 @@ out_fail:
 
 static int ipv6_frag_rcv(struct sk_buff **skbp)
 {
-        struct sk_buff *skb = *skbp; 
+        struct sk_buff *skb = *skbp;
         struct net_device *dev = skb->dev;
         struct frag_hdr *fhdr;
         struct frag_queue *fq;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 5f0043c30b70..0e1f4b2cd3dd 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3,7 +3,7 @@
  *      FIB front-end.
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      $Id: route.c,v 1.56 2001/10/31 21:55:55 davem Exp $
  *
@@ -201,7 +201,7 @@ static void ip6_dst_destroy(struct dst_entry *dst)
         if (idev != NULL) {
                 rt->rt6i_idev = NULL;
                 in6_dev_put(idev);
-        }       
+        }
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
@@ -243,7 +243,7 @@ static __inline__ struct rt6_info *rt6_device_match(struct rt6_info *rt,
         struct rt6_info *sprt;
 
         if (oif) {
-                for (sprt = rt; sprt; sprt = sprt->u.next) {
+                for (sprt = rt; sprt; sprt = sprt->u.dst.rt6_next) {
                         struct net_device *dev = sprt->rt6i_dev;
                         if (dev->ifindex == oif)
                                 return sprt;
@@ -252,7 +252,7 @@ static __inline__ struct rt6_info *rt6_device_match(struct rt6_info *rt,
                                     sprt->rt6i_idev->dev->ifindex != oif) {
                                         if (strict && oif)
                                                 continue;
-                                        if (local && (!oif || 
+                                        if (local && (!oif ||
                                                       local->rt6i_idev->dev->ifindex == oif))
                                                 continue;
                                 }
@@ -311,12 +311,21 @@ static inline void rt6_probe(struct rt6_info *rt)
 static int inline rt6_check_dev(struct rt6_info *rt, int oif)
 {
         struct net_device *dev = rt->rt6i_dev;
-        if (!oif || dev->ifindex == oif)
+        int ret = 0;
+
+        if (!oif)
                 return 2;
-        if ((dev->flags & IFF_LOOPBACK) &&
-            rt->rt6i_idev && rt->rt6i_idev->dev->ifindex == oif)
-                return 1;
-        return 0;
+        if (dev->flags & IFF_LOOPBACK) {
+                if (!WARN_ON(rt->rt6i_idev == NULL) &&
+                    rt->rt6i_idev->dev->ifindex == oif)
+                        ret = 1;
+                else
+                        return 0;
+        }
+        if (dev->ifindex == oif)
+                return 2;
+
+        return ret;
 }
 
 static int inline rt6_check_neigh(struct rt6_info *rt)
@@ -341,7 +350,7 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
                            int strict)
 {
         int m, n;
-                
+
         m = rt6_check_dev(rt, oif);
         if (!m && (strict & RT6_LOOKUP_F_IFACE))
                 return -1;
@@ -367,7 +376,7 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
 
         for (rt = rt0, metric = rt0->rt6i_metric;
              rt && rt->rt6i_metric == metric && (!last || rt != rt0);
-             rt = rt->u.next) {
+             rt = rt->u.dst.rt6_next) {
                 int m;
 
                 if (rt6_check_expired(rt))
@@ -395,9 +404,9 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
                 /* no entries matched; do round-robin */
                 static DEFINE_SPINLOCK(lock);
                 spin_lock(&lock);
-                *head = rt0->u.next;
-                rt0->u.next = last->u.next;
-                last->u.next = rt0;
+                *head = rt0->u.dst.rt6_next;
+                rt0->u.dst.rt6_next = last->u.dst.rt6_next;
+                last->u.dst.rt6_next = rt0;
                 spin_unlock(&lock);
         }
 
@@ -714,7 +723,7 @@ void ip6_route_input(struct sk_buff *skb)
                                 .flowlabel = (* (__be32 *) iph)&IPV6_FLOWINFO_MASK,
                         },
                 },
-                .mark = skb->mark,
+                .mark = skb->mark,
                 .proto = iph->nexthdr,
         };
 
@@ -879,9 +888,9 @@ static inline unsigned int ipv6_advmss(unsigned int mtu)
                 mtu = ip6_rt_min_advmss;
 
         /*
-         * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and 
-         * corresponding MSS is IPV6_MAXPLEN - tcp_header_size. 
-         * IPV6_MAXPLEN is also valid and means: "any MSS, 
+         * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
+         * corresponding MSS is IPV6_MAXPLEN - tcp_header_size.
+         * IPV6_MAXPLEN is also valid and means: "any MSS,
          * rely only on pmtu discovery"
          */
         if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
@@ -892,7 +901,7 @@ static inline unsigned int ipv6_advmss(unsigned int mtu)
 static struct dst_entry *ndisc_dst_gc_list;
 static DEFINE_SPINLOCK(ndisc_lock);
 
-struct dst_entry *ndisc_dst_alloc(struct net_device *dev, 
+struct dst_entry *ndisc_dst_alloc(struct net_device *dev,
                                   struct neighbour *neigh,
                                   struct in6_addr *addr,
                                   int (*output)(struct sk_buff *))
@@ -925,8 +934,8 @@ struct dst_entry *ndisc_dst_alloc(struct net_device *dev,
         rt->u.dst.output  = output;
 
 #if 0   /* there's no chance to use these for ndisc */
-        rt->u.dst.flags   = ipv6_addr_type(addr) & IPV6_ADDR_UNICAST 
-                                ? DST_HOST 
+        rt->u.dst.flags   = ipv6_addr_type(addr) & IPV6_ADDR_UNICAST
+                                ? DST_HOST
                                 : 0;
         ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
         rt->rt6i_dst.plen = 128;
@@ -949,7 +958,7 @@ int ndisc_dst_gc(int *more)
         int freed;
 
         next = NULL;
-        freed = 0;
+        freed = 0;
 
         spin_lock_bh(&ndisc_lock);
         pprev = &ndisc_dst_gc_list;
@@ -1267,9 +1276,9 @@ static int ip6_route_del(struct fib6_config *cfg)
         fn = fib6_locate(&table->tb6_root,
                          &cfg->fc_dst, cfg->fc_dst_len,
                          &cfg->fc_src, cfg->fc_src_len);
-        
+
         if (fn) {
-                for (rt = fn->leaf; rt; rt = rt->u.next) {
+                for (rt = fn->leaf; rt; rt = rt->u.dst.rt6_next) {
                         if (cfg->fc_ifindex &&
                             (rt->rt6i_dev == NULL ||
                              rt->rt6i_dev->ifindex != cfg->fc_ifindex))
@@ -1320,7 +1329,7 @@ static struct rt6_info *__ip6_route_redirect(struct fib6_table *table,
         read_lock_bh(&table->tb6_lock);
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 restart:
-        for (rt = fn->leaf; rt; rt = rt->u.next) {
+        for (rt = fn->leaf; rt; rt = rt->u.dst.rt6_next) {
                 /*
                  * Current route is on-link; redirect is always invalid.
                  *
@@ -1396,7 +1405,7 @@ void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
          *      We have finally decided to accept it.
          */
 
-        neigh_update(neigh, lladdr, NUD_STALE, 
+        neigh_update(neigh, lladdr, NUD_STALE,
                      NEIGH_UPDATE_F_WEAK_OVERRIDE|
                      NEIGH_UPDATE_F_OVERRIDE|
                      (on_link ? 0 : (NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
@@ -1445,7 +1454,7 @@ void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
         }
 
 out:
-        dst_release(&rt->u.dst);
+        dst_release(&rt->u.dst);
         return;
 }
 
@@ -1469,7 +1478,7 @@ void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
 
         if (pmtu < IPV6_MIN_MTU) {
                 /*
-                 * According to RFC2460, PMTU is set to the IPv6 Minimum Link 
+                 * According to RFC2460, PMTU is set to the IPv6 Minimum Link
                  * MTU (1280) and a fragment header should always be included
                  * after a node receiving Too Big message reporting PMTU is
                  * less than the IPv6 Minimum Link MTU.
@@ -1581,7 +1590,7 @@ static struct rt6_info *rt6_get_route_info(struct in6_addr *prefix, int prefixle
         if (!fn)
                 goto out;
 
-        for (rt = fn->leaf; rt; rt = rt->u.next) {
+        for (rt = fn->leaf; rt; rt = rt->u.dst.rt6_next) {
                 if (rt->rt6i_dev->ifindex != ifindex)
                         continue;
                 if ((rt->rt6i_flags & (RTF_ROUTEINFO|RTF_GATEWAY)) != (RTF_ROUTEINFO|RTF_GATEWAY))
@@ -1623,7 +1632,7 @@ static struct rt6_info *rt6_add_route_info(struct in6_addr *prefix, int prefixle
 #endif
 
 struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *dev)
-{       
+{
         struct rt6_info *rt;
         struct fib6_table *table;
 
@@ -1632,7 +1641,7 @@ struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *d
                 return NULL;
 
         write_lock_bh(&table->tb6_lock);
-        for (rt = table->tb6_root.leaf; rt; rt=rt->u.next) {
+        for (rt = table->tb6_root.leaf; rt; rt=rt->u.dst.rt6_next) {
                 if (dev == rt->rt6i_dev &&
                     ((rt->rt6i_flags & (RTF_ADDRCONF | RTF_DEFAULT)) == (RTF_ADDRCONF | RTF_DEFAULT)) &&
                     ipv6_addr_equal(&rt->rt6i_gateway, addr))
@@ -1675,7 +1684,7 @@ void rt6_purge_dflt_routers(void)
 
 restart:
         read_lock_bh(&table->tb6_lock);
-        for (rt = table->tb6_root.leaf; rt; rt = rt->u.next) {
+        for (rt = table->tb6_root.leaf; rt; rt = rt->u.dst.rt6_next) {
                 if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) {
                         dst_hold(&rt->u.dst);
                         read_unlock_bh(&table->tb6_lock);
@@ -1887,8 +1896,8 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
          */
         if (rt->rt6i_dev == arg->dev &&
             !dst_metric_locked(&rt->u.dst, RTAX_MTU) &&
-            (dst_mtu(&rt->u.dst) > arg->mtu ||
-             (dst_mtu(&rt->u.dst) < arg->mtu &&
+            (dst_mtu(&rt->u.dst) > arg->mtu ||
+             (dst_mtu(&rt->u.dst) < arg->mtu &&
               dst_mtu(&rt->u.dst) == idev->cnf.mtu6)))
                 rt->u.dst.metrics[RTAX_MTU-1] = arg->mtu;
         rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(arg->mtu);
@@ -2040,7 +2049,7 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*rtm), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         rtm = nlmsg_data(nlh);
         rtm->rtm_family = AF_INET6;
@@ -2074,13 +2083,13 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
 
         if (dst) {
                 NLA_PUT(skb, RTA_DST, 16, dst);
-                rtm->rtm_dst_len = 128;
+                rtm->rtm_dst_len = 128;
         } else if (rtm->rtm_dst_len)
                 NLA_PUT(skb, RTA_DST, 16, &rt->rt6i_dst.addr);
 #ifdef CONFIG_IPV6_SUBTREES
         if (src) {
                 NLA_PUT(skb, RTA_SRC, 16, src);
-                rtm->rtm_src_len = 128;
+                rtm->rtm_src_len = 128;
         } else if (rtm->rtm_src_len)
                 NLA_PUT(skb, RTA_SRC, 16, &rt->rt6i_src.addr);
 #endif
@@ -2111,7 +2120,8 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 int rt6_dump_route(struct rt6_info *rt, void *p_arg)
@@ -2222,9 +2232,12 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
                 goto errout;
 
         err = rt6_fill_node(skb, rt, NULL, NULL, 0, event, pid, seq, 0, 0);
-        /* failure implies BUG in rt6_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, pid, RTNLGRP_IPV6_ROUTE, nlh, gfp_any());
 errout:
         if (err < 0)
@@ -2286,7 +2299,7 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
         arg->len += sprintf(arg->buffer + arg->len,
                             " %08x %08x %08x %08x %8s\n",
                             rt->rt6i_metric, atomic_read(&rt->u.dst.__refcnt),
-                            rt->u.dst.__use, rt->rt6i_flags, 
+                            rt->u.dst.__use, rt->rt6i_flags,
                             rt->rt6i_dev ? rt->rt6i_dev->name : "");
         return 0;
 }
@@ -2332,7 +2345,7 @@ static int rt6_stats_seq_open(struct inode *inode, struct file *file)
         return single_open(file, rt6_stats_seq_show, NULL);
 }
 
-static struct file_operations rt6_stats_seq_fops = {
+static const struct file_operations rt6_stats_seq_fops = {
         .owner   = THIS_MODULE,
         .open    = rt6_stats_seq_open,
         .read    = seq_read,
@@ -2358,91 +2371,91 @@ int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write, struct file * filp,
 }
 
 ctl_table ipv6_route_table[] = {
-        {
-                .ctl_name       =       NET_IPV6_ROUTE_FLUSH, 
+        {
+                .ctl_name       =       NET_IPV6_ROUTE_FLUSH,
                 .procname       =       "flush",
-                .data           =       &flush_delay,
+                .data           =       &flush_delay,
                 .maxlen         =       sizeof(int),
                 .mode           =       0200,
-                .proc_handler   =       &ipv6_sysctl_rtcache_flush
+                .proc_handler   =       &ipv6_sysctl_rtcache_flush
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_THRESH,
                 .procname       =       "gc_thresh",
-                .data           =       &ip6_dst_ops.gc_thresh,
+                .data           =       &ip6_dst_ops.gc_thresh,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec,
+                .proc_handler   =       &proc_dointvec,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_MAX_SIZE,
                 .procname       =       "max_size",
-                .data           =       &ip6_rt_max_size,
+                .data           =       &ip6_rt_max_size,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec,
+                .proc_handler   =       &proc_dointvec,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_MIN_INTERVAL,
                 .procname       =       "gc_min_interval",
-                .data           =       &ip6_rt_gc_min_interval,
+                .data           =       &ip6_rt_gc_min_interval,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
+                .proc_handler   =       &proc_dointvec_jiffies,
                 .strategy       =       &sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_TIMEOUT,
                 .procname       =       "gc_timeout",
-                .data           =       &ip6_rt_gc_timeout,
+                .data           =       &ip6_rt_gc_timeout,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
+                .proc_handler   =       &proc_dointvec_jiffies,
                 .strategy       =       &sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_INTERVAL,
                 .procname       =       "gc_interval",
-                .data           =       &ip6_rt_gc_interval,
+                .data           =       &ip6_rt_gc_interval,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
+                .proc_handler   =       &proc_dointvec_jiffies,
                 .strategy       =       &sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_ELASTICITY,
                 .procname       =       "gc_elasticity",
-                .data           =       &ip6_rt_gc_elasticity,
+                .data           =       &ip6_rt_gc_elasticity,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
+                .proc_handler   =       &proc_dointvec_jiffies,
                 .strategy       =       &sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_MTU_EXPIRES,
                 .procname       =       "mtu_expires",
-                .data           =       &ip6_rt_mtu_expires,
+                .data           =       &ip6_rt_mtu_expires,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
+                .proc_handler   =       &proc_dointvec_jiffies,
                 .strategy       =       &sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_MIN_ADVMSS,
                 .procname       =       "min_adv_mss",
-                .data           =       &ip6_rt_min_advmss,
+                .data           =       &ip6_rt_min_advmss,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
+                .proc_handler   =       &proc_dointvec_jiffies,
                 .strategy       =       &sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_MIN_INTERVAL_MS,
                 .procname       =       "gc_min_interval_ms",
-                .data           =       &ip6_rt_gc_min_interval,
+                .data           =       &ip6_rt_gc_min_interval,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_ms_jiffies,
+                .proc_handler   =       &proc_dointvec_ms_jiffies,
                 .strategy       =       &sysctl_ms_jiffies,
         },
         { .ctl_name = 0 }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 77b7b0911438..4d3cf301e1fc 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -3,7 +3,7 @@
  *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  *
  *      $Id: sit.c,v 1.53 2001/09/25 05:09:53 davem Exp $
@@ -410,7 +410,7 @@ static inline __be32 try_6to4(struct in6_addr *v6dst)
         __be32 dst = 0;
 
         if (v6dst->s6_addr16[0] == htons(0x2002)) {
-                /* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
+                /* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
                 memcpy(&dst, &v6dst->s6_addr16[1], 4);
         }
         return dst;
@@ -434,7 +434,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         int    max_headroom;                    /* The extra header space needed */
         __be32 dst = tiph->daddr;
         int    mtu;
-        struct in6_addr *addr6; 
+        struct in6_addr *addr6;
         int addr_type;
 
         if (tunnel->recursion++) {
@@ -537,7 +537,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        stats->tx_dropped++;
                         dev_kfree_skb(skb);
                         tunnel->recursion--;
                         return 0;
@@ -686,7 +686,8 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                 goto done;
                         dev = t->dev;
                 }
-                err = unregister_netdevice(dev);
+                unregister_netdevice(dev);
+                err = 0;
                 break;
 
         default:
@@ -830,7 +831,7 @@ static int __init sit_init(void)
                 return -EAGAIN;
         }
 
-        ipip6_fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "sit0", 
+        ipip6_fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "sit0",
                                            ipip6_tunnel_setup);
         if (!ipip6_fb_tunnel_dev) {
                 err = -ENOMEM;
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 7a4639db1346..25e8e7783fee 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -92,7 +92,7 @@ static ctl_table ipv6_net_table[] = {
                 .mode           = 0555,
                 .child          = ipv6_table
         },
-        { .ctl_name = 0 }
+        { .ctl_name = 0 }
 };
 
 static ctl_table ipv6_root_table[] = {
@@ -102,7 +102,7 @@ static ctl_table ipv6_root_table[] = {
                 .mode           = 0555,
                 .child          = ipv6_net_table
         },
-        { .ctl_name = 0 }
+        { .ctl_name = 0 }
 };
 
 void ipv6_sysctl_register(void)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index c25e930c2c69..f57a9baa6b27 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1,13 +1,13 @@
 /*
  *      TCP over IPv6
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
  *
- *      Based on: 
+ *      Based on:
  *      linux/net/ipv4/tcp.c
  *      linux/net/ipv4/tcp_input.c
  *      linux/net/ipv4/tcp_output.c
@@ -74,7 +74,7 @@ static struct socket *tcp6_socket;
 
 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
-static void     tcp_v6_send_check(struct sock *sk, int len, 
+static void     tcp_v6_send_check(struct sock *sk, int len,
                                   struct sk_buff *skb);
 
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
@@ -106,8 +106,8 @@ static void tcp_v6_hash(struct sock *sk)
 }
 
 static __inline__ __sum16 tcp_v6_check(struct tcphdr *th, int len,
-                                   struct in6_addr *saddr, 
-                                   struct in6_addr *daddr, 
+                                   struct in6_addr *saddr,
+                                   struct in6_addr *daddr,
                                    __wsum base)
 {
         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
@@ -121,11 +121,11 @@ static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
                                             skb->h.th->source);
 }
 
-static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, 
+static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                           int addr_len)
 {
         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
-        struct inet_sock *inet = inet_sk(sk);
+        struct inet_sock *inet = inet_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
@@ -135,10 +135,10 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         int addr_type;
         int err;
 
-        if (addr_len < SIN6_LEN_RFC2133) 
+        if (addr_len < SIN6_LEN_RFC2133)
                 return -EINVAL;
 
-        if (usin->sin6_family != AF_INET6) 
+        if (usin->sin6_family != AF_INET6)
                 return(-EAFNOSUPPORT);
 
         memset(&fl, 0, sizeof(fl));
@@ -157,11 +157,11 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         }
 
         /*
-         *      connect() to INADDR_ANY means loopback (BSD'ism).
-         */
-        
-        if(ipv6_addr_any(&usin->sin6_addr))
-                usin->sin6_addr.s6_addr[15] = 0x1; 
+         *      connect() to INADDR_ANY means loopback (BSD'ism).
+         */
+
+        if(ipv6_addr_any(&usin->sin6_addr))
+                usin->sin6_addr.s6_addr[15] = 0x1;
 
         addr_type = ipv6_addr_type(&usin->sin6_addr);
 
@@ -265,7 +265,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+        if ((err = xfrm_lookup(&dst, &fl, sk, 1)) < 0)
                 goto failure;
 
         if (saddr == NULL) {
@@ -323,7 +323,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct ipv6_pinfo *np;
         struct sock *sk;
         int err;
-        struct tcp_sock *tp; 
+        struct tcp_sock *tp;
         __u32 seq;
 
         sk = inet6_lookup(&tcp_hashinfo, &hdr->daddr, th->dest, &hdr->saddr,
@@ -347,7 +347,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 goto out;
 
         tp = tcp_sk(sk);
-        seq = ntohl(th->seq); 
+        seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
             !between(seq, tp->snd_una, tp->snd_nxt)) {
                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
@@ -434,7 +434,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         case TCP_SYN_SENT:
         case TCP_SYN_RECV:  /* Cannot happen.
-                               It can, it SYNs are crossed. --ANK */ 
+                               It can, it SYNs are crossed. --ANK */
                 if (!sock_owned_by_user(sk)) {
                         sk->sk_err = err;
                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
@@ -519,7 +519,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         }
 
 done:
-        if (opt && opt != np->opt)
+        if (opt && opt != np->opt)
                 sock_kfree_s(sk, opt, opt->tot_len);
         dst_release(dst);
         return err;
@@ -950,8 +950,8 @@ static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
-                th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP, 
-                                            csum_partial((char *)th, th->doff<<2, 
+                th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
+                                            csum_partial((char *)th, th->doff<<2,
                                                          skb->csum));
         }
 }
@@ -977,7 +977,7 @@ static int tcp_v6_gso_send_check(struct sk_buff *skb)
 
 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 {
-        struct tcphdr *th = skb->h.th, *t1; 
+        struct tcphdr *th = skb->h.th, *t1;
         struct sk_buff *buff;
         struct flowi fl;
         int tot_len = sizeof(*th);
@@ -989,7 +989,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                 return;
 
         if (!ipv6_unicast_destination(skb))
-                return; 
+                return;
 
 #ifdef CONFIG_TCP_MD5SIG
         if (sk)
@@ -1008,8 +1008,8 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 
         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
                          GFP_ATOMIC);
-        if (buff == NULL) 
-                return;
+        if (buff == NULL)
+                return;
 
         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 
@@ -1021,9 +1021,9 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
         t1->source = th->dest;
         t1->doff = tot_len / 4;
         t1->rst = 1;
-  
+
         if(th->ack) {
-                t1->seq = th->ack_seq;
+                t1->seq = th->ack_seq;
         } else {
                 t1->ack = 1;
                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
@@ -1128,7 +1128,7 @@ static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
         t1->window = htons(win);
 
         topt = (__be32 *)(t1 + 1);
-        
+
         if (ts) {
                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
@@ -1243,15 +1243,15 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 return tcp_v4_conn_request(sk, skb);
 
         if (!ipv6_unicast_destination(skb))
-                goto drop; 
+                goto drop;
 
         /*
-         *      There are no SYN attacks on IPv6, yet...        
+         *      There are no SYN attacks on IPv6, yet...
          */
         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
                 if (net_ratelimit())
                         printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
-                goto drop;              
+                goto drop;
         }
 
         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
@@ -1292,7 +1292,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
                 treq->iif = inet6_iif(skb);
 
-        if (isn == 0) 
+        if (isn == 0)
                 isn = tcp_v6_init_sequence(skb);
 
         tcp_rsk(req)->snt_isn = isn;
@@ -1334,7 +1334,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
 
-                if (newsk == NULL) 
+                if (newsk == NULL)
                         return NULL;
 
                 newtcp6sk = (struct tcp6_sock *)newsk;
@@ -1419,7 +1419,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
                         goto out;
-        } 
+        }
 
         newsk = tcp_create_openreq_child(sk, req, skb);
         if (newsk == NULL)
@@ -1448,7 +1448,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
         newsk->sk_bound_dev_if = treq->iif;
 
-        /* Now IPv6 options... 
+        /* Now IPv6 options...
 
            First: no IPv4 options.
          */
@@ -1592,7 +1592,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
            looks not very well thought. For now we latch
            options, received in the last packet, enqueued
            by tcp. Feel free to propose better solution.
-                                               --ANK (980728)
+                                               --ANK (980728)
          */
         if (np->rxopt.all)
                 opt_skb = skb_clone(skb, GFP_ATOMIC);
@@ -1610,7 +1610,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
         if (skb->len < (skb->h.th->doff<<2) || tcp_checksum_complete(skb))
                 goto csum_err;
 
-        if (sk->sk_state == TCP_LISTEN) { 
+        if (sk->sk_state == TCP_LISTEN) {
                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
                 if (!nsk)
                         goto discard;
@@ -1620,7 +1620,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                  * otherwise we just shortcircuit this and continue with
                  * the new socket..
                  */
-                if(nsk != sk) {
+                if(nsk != sk) {
                         if (tcp_child_process(sk, nsk, skb))
                                 goto reset;
                         if (opt_skb)
@@ -1681,7 +1681,7 @@ ipv6_pktoptions:
 static int tcp_v6_rcv(struct sk_buff **pskb)
 {
         struct sk_buff *skb = *pskb;
-        struct tcphdr *th;      
+        struct tcphdr *th;
         struct sock *sk;
         int ret;
 
@@ -1739,10 +1739,10 @@ process:
         ret = 0;
         if (!sock_owned_by_user(sk)) {
 #ifdef CONFIG_NET_DMA
-                struct tcp_sock *tp = tcp_sk(sk);
-                if (tp->ucopy.dma_chan)
-                        ret = tcp_v6_do_rcv(sk, skb);
-                else
+                struct tcp_sock *tp = tcp_sk(sk);
+                if (tp->ucopy.dma_chan)
+                        ret = tcp_v6_do_rcv(sk, skb);
+                else
 #endif
                 {
                         if (!tcp_prequeue(sk, skb))
@@ -1945,7 +1945,7 @@ static int tcp_v6_destroy_sock(struct sock *sk)
 }
 
 /* Proc filesystem TCPv6 sock list dumping. */
-static void get_openreq6(struct seq_file *seq, 
+static void get_openreq6(struct seq_file *seq,
                          struct sock *sk, struct request_sock *req, int i, int uid)
 {
         int ttd = req->expires - jiffies;
@@ -1967,11 +1967,11 @@ static void get_openreq6(struct seq_file *seq,
                    ntohs(inet_rsk(req)->rmt_port),
                    TCP_SYN_RECV,
                    0,0, /* could print option size, but that is af dependent. */
-                   1,   /* timers active (only the expire timer) */  
-                   jiffies_to_clock_t(ttd), 
+                   1,   /* timers active (only the expire timer) */
+                   jiffies_to_clock_t(ttd),
                    req->retrans,
                    uid,
-                   0,  /* non standard timer */  
+                   0,  /* non standard timer */
                    0, /* open_requests have no inode */
                    0, req);
 }
@@ -2014,7 +2014,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
                    dest->s6_addr32[0], dest->s6_addr32[1],
                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
-                   sp->sk_state, 
+                   sp->sk_state,
                    tp->write_seq-tp->snd_una,
                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
                    timer_active,
@@ -2031,7 +2031,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                    );
 }
 
-static void get_timewait6_sock(struct seq_file *seq, 
+static void get_timewait6_sock(struct seq_file *seq,
                                struct inet_timewait_sock *tw, int i)
 {
         struct in6_addr *dest, *src;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index f52a5c3cc0a3..ccf2f4d196be 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1,9 +1,9 @@
 /*
  *      UDP over IPv6
- *      Linux INET6 implementation 
+ *      Linux INET6 implementation
  *
  *      Authors:
- *      Pedro Roque             <roque@di.fc.ul.pt>     
+ *      Pedro Roque             <roque@di.fc.ul.pt>
  *
  *      Based on linux/ipv4/udp.c
  *
@@ -67,11 +67,11 @@ static struct sock *__udp6_lib_lookup(struct in6_addr *saddr, __be16 sport,
         unsigned short hnum = ntohs(dport);
         int badness = -1;
 
-        read_lock(&udp_hash_lock);
+        read_lock(&udp_hash_lock);
         sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
                 struct inet_sock *inet = inet_sk(sk);
 
-                if (inet->num == hnum && sk->sk_family == PF_INET6) {
+                if (sk->sk_hash == hnum && sk->sk_family == PF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
                         int score = 0;
                         if (inet->dport) {
@@ -105,7 +105,7 @@ static struct sock *__udp6_lib_lookup(struct in6_addr *saddr, __be16 sport,
         }
         if (result)
                 sock_hold(result);
-        read_unlock(&udp_hash_lock);
+        read_unlock(&udp_hash_lock);
         return result;
 }
 
@@ -120,13 +120,13 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
-        struct sk_buff *skb;
+        struct sk_buff *skb;
         size_t copied;
         int err, copy_only, is_udplite = IS_UDPLITE(sk);
 
-        if (addr_len)
-                *addr_len=sizeof(struct sockaddr_in6);
-  
+        if (addr_len)
+                *addr_len=sizeof(struct sockaddr_in6);
+
         if (flags & MSG_ERRQUEUE)
                 return ipv6_recv_error(sk, msg, len);
 
@@ -135,11 +135,11 @@ try_again:
         if (!skb)
                 goto out;
 
-        copied = skb->len - sizeof(struct udphdr);
-        if (copied > len) {
-                copied = len;
-                msg->msg_flags |= MSG_TRUNC;
-        }
+        copied = skb->len - sizeof(struct udphdr);
+        if (copied > len) {
+                copied = len;
+                msg->msg_flags |= MSG_TRUNC;
+        }
 
         /*
          *      Decide whether to checksum and/or copy data.
@@ -168,7 +168,7 @@ try_again:
         /* Copy the address. */
         if (msg->msg_name) {
                 struct sockaddr_in6 *sin6;
-          
+
                 sin6 = (struct sockaddr_in6 *) msg->msg_name;
                 sin6->sin6_family = AF_INET6;
                 sin6->sin6_port = skb->h.uh->source;
@@ -191,7 +191,7 @@ try_again:
         } else {
                 if (np->rxopt.all)
                         datagram_recv_ctl(sk, msg, skb);
-        }
+        }
 
         err = copied;
         if (flags & MSG_TRUNC)
@@ -309,7 +309,7 @@ static struct sock *udp_v6_mcast_next(struct sock *sk,
         sk_for_each_from(s, node) {
                 struct inet_sock *inet = inet_sk(s);
 
-                if (inet->num == num && s->sk_family == PF_INET6) {
+                if (s->sk_hash == num && s->sk_family == PF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(s);
                         if (inet->dport) {
                                 if (inet->dport != rmt_port)
@@ -339,7 +339,7 @@ static struct sock *udp_v6_mcast_next(struct sock *sk,
  * so we don't need to lock the hashes.
  */
 static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr,
-                           struct in6_addr *daddr, struct hlist_head udptable[])
+                           struct in6_addr *daddr, struct hlist_head udptable[])
 {
         struct sock *sk, *sk2;
         const struct udphdr *uh = skb->h.uh;
@@ -379,7 +379,7 @@ static inline int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh)
         }
         if (skb->ip_summed == CHECKSUM_COMPLETE &&
             !csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
-                             skb->len, IPPROTO_UDP, skb->csum             ))
+                             skb->len, IPPROTO_UDP, skb->csum             ))
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 
         if (skb->ip_summed != CHECKSUM_UNNECESSARY)
@@ -396,7 +396,7 @@ int __udp6_lib_rcv(struct sk_buff **pskb, struct hlist_head udptable[],
 {
         struct sk_buff *skb = *pskb;
         struct sock *sk;
-        struct udphdr *uh;
+        struct udphdr *uh;
         struct net_device *dev = skb->dev;
         struct in6_addr *saddr, *daddr;
         u32 ulen = 0;
@@ -437,15 +437,15 @@ int __udp6_lib_rcv(struct sk_buff **pskb, struct hlist_head udptable[],
                         goto discard;
         }
 
-        /* 
-         *      Multicast receive code 
+        /*
+         *      Multicast receive code
          */
         if (ipv6_addr_is_multicast(daddr))
                 return __udp6_lib_mcast_deliver(skb, saddr, daddr, udptable);
 
         /* Unicast */
 
-        /* 
+        /*
          * check socket cache ... must talk to Alan about his plans
          * for sock caches... i'll skip this for now.
          */
@@ -465,21 +465,21 @@ int __udp6_lib_rcv(struct sk_buff **pskb, struct hlist_head udptable[],
                 kfree_skb(skb);
                 return(0);
         }
-        
+
         /* deliver */
-        
+
         udpv6_queue_rcv_skb(sk, skb);
         sock_put(sk);
         return(0);
 
-short_packet:   
+short_packet:
         LIMIT_NETDEBUG(KERN_DEBUG "UDP%sv6: short packet: %d/%u\n",
                        is_udplite? "-Lite" : "",  ulen, skb->len);
 
 discard:
         UDP6_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
         kfree_skb(skb);
-        return(0);      
+        return(0);
 }
 
 static __inline__ int udpv6_rcv(struct sk_buff **pskb)
@@ -498,7 +498,7 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
                 up->len = 0;
                 up->pending = 0;
                 ip6_flush_pending_frames(sk);
-        }
+        }
 }
 
 /*
@@ -594,7 +594,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
                 daddr = &np->daddr;
-        } else 
+        } else
                 daddr = NULL;
 
         if (daddr) {
@@ -620,7 +620,7 @@ do_udp_sendmsg:
            */
         if (len > INT_MAX - sizeof(struct udphdr))
                 return -EMSGSIZE;
-        
+
         if (up->pending) {
                 /*
                  * There are pending frames.
@@ -713,7 +713,7 @@ do_udp_sendmsg:
         if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
                 ipv6_addr_copy(&fl.fl6_src, &np->saddr);
         fl.fl_ip_sport = inet->sport;
-        
+
         /* merge ip6_build_xmit from ip6_output */
         if (opt && opt->srcrt) {
                 struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
@@ -736,7 +736,7 @@ do_udp_sendmsg:
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+        if ((err = xfrm_lookup(&dst, &fl, sk, 1)) < 0)
                 goto out;
 
         if (hlimit < 0) {
@@ -911,7 +911,7 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
                    dest->s6_addr32[0], dest->s6_addr32[1],
                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
-                   sp->sk_state, 
+                   sp->sk_state,
                    atomic_read(&sp->sk_wmem_alloc),
                    atomic_read(&sp->sk_rmem_alloc),
                    0, 0L, 0,
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index ec9878899128..6e252f318f7c 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -11,9 +11,9 @@ extern void 	__udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *,
                                int , int , int , __be32 , struct hlist_head []);
 
 extern int      udpv6_getsockopt(struct sock *sk, int level, int optname,
-                                 char __user *optval, int __user *optlen);
+                                 char __user *optval, int __user *optlen);
 extern int      udpv6_setsockopt(struct sock *sk, int level, int optname,
-                                 char __user *optval, int optlen);
+                                 char __user *optval, int optlen);
 #ifdef CONFIG_COMPAT
 extern int      compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
                                         char __user *optval, int optlen);
@@ -24,7 +24,7 @@ extern int	udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                               struct msghdr *msg, size_t len);
 extern int      udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                               struct msghdr *msg, size_t len,
-                              int noblock, int flags, int *addr_len);
+                              int noblock, int flags, int *addr_len);
 extern int      udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
 extern int      udpv6_destroy_sock(struct sock *sk);
 
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 5c8b7a568800..25250147bdc3 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -33,7 +33,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi)
         seq = 0;
         if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0)
                 goto drop;
-        
+
         do {
                 struct ipv6hdr *iph = skb->nh.ipv6h;
 
@@ -115,7 +115,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi)
                 __skb_push(skb, skb->data - skb->nh.raw);
 
                 NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
-                        ip6_rcv_finish);
+                        ip6_rcv_finish);
                 return -1;
 #else
                 return 1;
@@ -142,12 +142,12 @@ int xfrm6_rcv(struct sk_buff **pskb)
 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                      xfrm_address_t *saddr, u8 proto)
 {
-        struct xfrm_state *x = NULL;
-        int wildcard = 0;
+        struct xfrm_state *x = NULL;
+        int wildcard = 0;
         struct in6_addr any;
         xfrm_address_t *xany;
         struct xfrm_state *xfrm_vec_one = NULL;
-        int nh = 0;
+        int nh = 0;
         int i = 0;
 
         ipv6_addr_set(&any, 0, 0, 0, 0);
@@ -168,12 +168,12 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                         break;
                 case 2:
                 default:
-                        /* lookup state with wild-card addresses */
+                        /* lookup state with wild-card addresses */
                         wildcard = 1; /* XXX */
                         dst = xany;
                         src = xany;
                         break;
-                }
+                }
 
                 x = xfrm_state_lookup_byaddr(dst, src, proto, AF_INET6);
                 if (!x)
@@ -193,8 +193,8 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                 if (unlikely(x->km.state != XFRM_STATE_VALID)) {
                         spin_unlock(&x->lock);
                         xfrm_state_put(x);
-                        x = NULL;
-                        continue;
+                        x = NULL;
+                        continue;
                 }
                 if (xfrm_state_check_expire(x)) {
                         spin_unlock(&x->lock);
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 5e7d8a7d6414..0bc866c0d83c 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -25,6 +25,12 @@ static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)
                 IP6_ECN_set_ce(inner_iph);
 }
 
+static inline void ip6ip_ecn_decapsulate(struct sk_buff *skb)
+{
+        if (INET_ECN_is_ce(ipv6_get_dsfield(skb->nh.ipv6h)))
+                        IP_ECN_set_ce(skb->h.ipiph);
+}
+
 /* Add encapsulation header.
  *
  * The top IP header will be constructed per RFC 2401.  The following fields
@@ -40,6 +46,7 @@ static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)
 static int xfrm6_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct dst_entry *dst = skb->dst;
+        struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
         struct ipv6hdr *iph, *top_iph;
         int dsfield;
 
@@ -52,16 +59,24 @@ static int xfrm6_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
         skb->h.ipv6h = top_iph + 1;
 
         top_iph->version = 6;
-        top_iph->priority = iph->priority;
-        top_iph->flow_lbl[0] = iph->flow_lbl[0];
-        top_iph->flow_lbl[1] = iph->flow_lbl[1];
-        top_iph->flow_lbl[2] = iph->flow_lbl[2];
+        if (xdst->route->ops->family == AF_INET6) {
+                top_iph->priority = iph->priority;
+                top_iph->flow_lbl[0] = iph->flow_lbl[0];
+                top_iph->flow_lbl[1] = iph->flow_lbl[1];
+                top_iph->flow_lbl[2] = iph->flow_lbl[2];
+                top_iph->nexthdr = IPPROTO_IPV6;
+        } else {
+                top_iph->priority = 0;
+                top_iph->flow_lbl[0] = 0;
+                top_iph->flow_lbl[1] = 0;
+                top_iph->flow_lbl[2] = 0;
+                top_iph->nexthdr = IPPROTO_IPIP;
+        }
         dsfield = ipv6_get_dsfield(top_iph);
         dsfield = INET_ECN_encapsulate(dsfield, dsfield);
         if (x->props.flags & XFRM_STATE_NOECN)
                 dsfield &= ~INET_ECN_MASK;
         ipv6_change_dsfield(top_iph, 0, dsfield);
-        top_iph->nexthdr = IPPROTO_IPV6; 
         top_iph->hop_limit = dst_metric(dst->child, RTAX_HOPLIMIT);
         ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
         ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
@@ -72,7 +87,8 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = -EINVAL;
 
-        if (skb->nh.raw[IP6CB(skb)->nhoff] != IPPROTO_IPV6)
+        if (skb->nh.raw[IP6CB(skb)->nhoff] != IPPROTO_IPV6
+            && skb->nh.raw[IP6CB(skb)->nhoff] != IPPROTO_IPIP)
                 goto out;
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 goto out;
@@ -81,10 +97,16 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
             (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
                 goto out;
 
-        if (x->props.flags & XFRM_STATE_DECAP_DSCP)
-                ipv6_copy_dscp(skb->nh.ipv6h, skb->h.ipv6h);
-        if (!(x->props.flags & XFRM_STATE_NOECN))
-                ipip6_ecn_decapsulate(skb);
+        if (skb->nh.raw[IP6CB(skb)->nhoff] == IPPROTO_IPV6) {
+                if (x->props.flags & XFRM_STATE_DECAP_DSCP)
+                        ipv6_copy_dscp(skb->nh.ipv6h, skb->h.ipv6h);
+                if (!(x->props.flags & XFRM_STATE_NOECN))
+                        ipip6_ecn_decapsulate(skb);
+        } else {
+                if (!(x->props.flags & XFRM_STATE_NOECN))
+                        ip6ip_ecn_decapsulate(skb);
+                skb->protocol = htons(ETH_P_IP);
+        }
         skb->mac.raw = memmove(skb->data - skb->mac_len,
                                skb->mac.raw, skb->mac_len);
         skb->nh.raw = skb->data;
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index c260ea104c52..d6d786b89d2b 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -2,7 +2,7 @@
  * xfrm6_output.c - Common IPsec encapsulation code for IPv6.
  * Copyright (C) 2002 USAGI/WIDE Project
  * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au>
- * 
+ *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version
@@ -46,7 +46,7 @@ static int xfrm6_output_one(struct sk_buff *skb)
         struct dst_entry *dst = skb->dst;
         struct xfrm_state *x = dst->xfrm;
         int err;
-        
+
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 err = skb_checksum_help(skb);
                 if (err)
@@ -81,7 +81,7 @@ static int xfrm6_output_one(struct sk_buff *skb)
                 spin_unlock_bh(&x->lock);
 
                 skb->nh.raw = skb->data;
-                
+
                 if (!(skb->dst = dst_pop(dst))) {
                         err = -EHOSTUNREACH;
                         goto error_nolock;
@@ -108,7 +108,7 @@ static int xfrm6_output_finish2(struct sk_buff *skb)
 
         while (likely((err = xfrm6_output_one(skb)) == 0)) {
                 nf_reset(skb);
-        
+
                 err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, &skb, NULL,
                               skb->dst->dev, dst_output);
                 if (unlikely(err != 1))
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8dffd4daae9c..b1133f27c8ae 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -8,7 +8,7 @@
  *              IPv6 support
  *      YOSHIFUJI Hideaki
  *              Split up af-specific portion
- * 
+ *
  */
 
 #include <linux/compiler.h>
@@ -131,13 +131,11 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
         struct dst_entry *dst, *dst_prev;
         struct rt6_info *rt0 = (struct rt6_info*)(*dst_p);
         struct rt6_info *rt  = rt0;
-        struct in6_addr *remote = &fl->fl6_dst;
-        struct in6_addr *local  = &fl->fl6_src;
         struct flowi fl_tunnel = {
                 .nl_u = {
                         .ip6_u = {
-                                .saddr = *local,
-                                .daddr = *remote
+                                .saddr = fl->fl6_src,
+                                .daddr = fl->fl6_dst,
                         }
                 }
         };
@@ -153,7 +151,6 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
         for (i = 0; i < nx; i++) {
                 struct dst_entry *dst1 = dst_alloc(&xfrm6_dst_ops);
                 struct xfrm_dst *xdst;
-                int tunnel = 0;
 
                 if (unlikely(dst1 == NULL)) {
                         err = -ENOBUFS;
@@ -177,19 +174,29 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
                 dst1->next = dst_prev;
                 dst_prev = dst1;
-                if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
-                        remote = __xfrm6_bundle_addr_remote(xfrm[i], remote);
-                        local  = __xfrm6_bundle_addr_local(xfrm[i], local);
-                        tunnel = 1;
-                }
+
                 __xfrm6_bundle_len_inc(&header_len, &nfheader_len, xfrm[i]);
                 trailer_len += xfrm[i]->props.trailer_len;
 
-                if (tunnel) {
-                        ipv6_addr_copy(&fl_tunnel.fl6_dst, remote);
-                        ipv6_addr_copy(&fl_tunnel.fl6_src, local);
+                if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL ||
+                    xfrm[i]->props.mode == XFRM_MODE_ROUTEOPTIMIZATION) {
+                        unsigned short encap_family = xfrm[i]->props.family;
+                        switch(encap_family) {
+                        case AF_INET:
+                                fl_tunnel.fl4_dst = xfrm[i]->id.daddr.a4;
+                                fl_tunnel.fl4_src = xfrm[i]->props.saddr.a4;
+                                break;
+                        case AF_INET6:
+                                ipv6_addr_copy(&fl_tunnel.fl6_dst, __xfrm6_bundle_addr_remote(xfrm[i], &fl->fl6_dst));
+
+                                ipv6_addr_copy(&fl_tunnel.fl6_src, __xfrm6_bundle_addr_remote(xfrm[i], &fl->fl6_src));
+                                break;
+                        default:
+                                BUG_ON(1);
+                        }
+
                         err = xfrm_dst_lookup((struct xfrm_dst **) &rt,
-                                              &fl_tunnel, AF_INET6);
+                                              &fl_tunnel, encap_family);
                         if (err)
                                 goto error;
                 } else
@@ -208,6 +215,7 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
         i = 0;
         for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
                 struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
+                struct xfrm_state_afinfo *afinfo;
 
                 dst_prev->xfrm = xfrm[i++];
                 dst_prev->dev = rt->u.dst.dev;
@@ -224,16 +232,26 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 /* Copy neighbour for reachability confirmation */
                 dst_prev->neighbour     = neigh_clone(rt->u.dst.neighbour);
                 dst_prev->input         = rt->u.dst.input;
-                dst_prev->output        = xfrm6_output;
+                /* XXX: When IPv4 is implemented as module and can be unloaded,
+                 * we should manage reference to xfrm4_output in afinfo->output.
+                 * Miyazawa
+                 */
+                afinfo = xfrm_state_get_afinfo(dst_prev->xfrm->props.family);
+                if (!afinfo) {
+                        dst = *dst_p;
+                        goto error;
+                };
+                dst_prev->output = afinfo->output;
+                xfrm_state_put_afinfo(afinfo);
                 /* Sheit... I remember I did this right. Apparently,
                  * it was magically lost, so this code needs audit */
                 x->u.rt6.rt6i_flags    = rt0->rt6i_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
                 x->u.rt6.rt6i_metric   = rt0->rt6i_metric;
                 x->u.rt6.rt6i_node     = rt0->rt6i_node;
                 x->u.rt6.rt6i_gateway  = rt0->rt6i_gateway;
-                memcpy(&x->u.rt6.rt6i_gateway, &rt0->rt6i_gateway, sizeof(x->u.rt6.rt6i_gateway)); 
+                memcpy(&x->u.rt6.rt6i_gateway, &rt0->rt6i_gateway, sizeof(x->u.rt6.rt6i_gateway));
                 x->u.rt6.rt6i_dst      = rt0->rt6i_dst;
-                x->u.rt6.rt6i_src      = rt0->rt6i_src; 
+                x->u.rt6.rt6i_src      = rt0->rt6i_src;
                 x->u.rt6.rt6i_idev     = rt0->rt6i_idev;
                 in6_dev_hold(rt0->rt6i_idev);
                 __xfrm6_bundle_len_dec(&header_len, &nfheader_len, x->u.dst.xfrm);
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index 9ddaa9d41539..baa461b9f74e 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -8,7 +8,7 @@
  *              IPv6 support
  *      YOSHIFUJI Hideaki @USAGI
  *              Split up af-specific portion
- *      
+ *
  */
 
 #include <net/xfrm.h>
@@ -171,6 +171,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = {
         .init_tempsel           = __xfrm6_init_tempsel,
         .tmpl_sort              = __xfrm6_tmpl_sort,
         .state_sort             = __xfrm6_state_sort,
+        .output                 = xfrm6_output,
 };
 
 void __init xfrm6_state_init(void)
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 12e426b9aacd..fb0228772f01 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -5,12 +5,12 @@
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
@@ -32,7 +32,7 @@
 #include <linux/mutex.h>
 
 /*
- * xfrm_tunnel_spi things are for allocating unique id ("spi") 
+ * xfrm_tunnel_spi things are for allocating unique id ("spi")
  * per xfrm_address_t.
  */
 struct xfrm6_tunnel_spi {
@@ -155,8 +155,8 @@ static u32 __xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
 
         for (spi = xfrm6_tunnel_spi; spi <= XFRM6_TUNNEL_SPI_MAX; spi++) {
                 index = xfrm6_tunnel_spi_hash_byspi(spi);
-                hlist_for_each_entry(x6spi, pos, 
-                                     &xfrm6_tunnel_spi_byspi[index], 
+                hlist_for_each_entry(x6spi, pos,
+                                     &xfrm6_tunnel_spi_byspi[index],
                                      list_byspi) {
                         if (x6spi->spi == spi)
                                 goto try_next_1;
@@ -167,8 +167,8 @@ try_next_1:;
         }
         for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tunnel_spi; spi++) {
                 index = xfrm6_tunnel_spi_hash_byspi(spi);
-                hlist_for_each_entry(x6spi, pos, 
-                                     &xfrm6_tunnel_spi_byspi[index], 
+                hlist_for_each_entry(x6spi, pos,
+                                     &xfrm6_tunnel_spi_byspi[index],
                                      list_byspi) {
                         if (x6spi->spi == spi)
                                 goto try_next_2;
@@ -222,7 +222,7 @@ void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
 
         write_lock_bh(&xfrm6_tunnel_spi_lock);
 
-        hlist_for_each_entry_safe(x6spi, pos, n, 
+        hlist_for_each_entry_safe(x6spi, pos, n,
                                   &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                                   list_byaddr)
         {
@@ -269,9 +269,9 @@ static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
         /* xfrm6_tunnel native err handling */
         switch (type) {
-        case ICMPV6_DEST_UNREACH: 
+        case ICMPV6_DEST_UNREACH:
                 switch (code) {
-                case ICMPV6_NOROUTE: 
+                case ICMPV6_NOROUTE:
                 case ICMPV6_ADM_PROHIBITED:
                 case ICMPV6_NOT_NEIGHBOUR:
                 case ICMPV6_ADDR_UNREACH:
@@ -287,7 +287,7 @@ static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 case ICMPV6_EXC_HOPLIMIT:
                         break;
                 case ICMPV6_EXC_FRAGTIME:
-                default: 
+                default:
                         break;
                 }
                 break;